feat(security): secret-scanner, commit-guard, llm-redaction, audit-log

- lib/secrets.ts: shared SECRET_PATTERNS + scanSecrets/redact (AWS/GitLab/GitHub/Slack tokens, private keys, JWT, generic credentials)
- lib/audit.ts: local JSONL audit (~/.config/pi-kit/audit.jsonl, 600), optional PI_KIT_AUDIT_URL POST; never logs secret values
- secret-scanner: block write/edit whose content matches a secret (complements protected-paths)
- commit-guard: enforce Conventional Commits on 'git commit -m' + scan message for secrets
- llm-redaction: redact secrets from outbound payload via before_provider_request
- audit-log: session_start + slash-command usage; wires company.json auditEndpoint into env
- config: auditEndpoint (null); package.json: npm test; test/guardrails.test.ts (16 cases, all pass)

Verified: all extensions load via pi (lib/ not loaded as extensions); npm test green.

extensions/lib/secrets.ts

@@ -0,0 +1,49 @@
+/**
+ * Shared secret detection/redaction used by secret-scanner, commit-guard and
+ * llm-redaction extensions.
+ *
+ * CONFIGURE: add entries to SECRET_PATTERNS below. Each pattern has a `name`
+ * (shown in warnings/audit, never the secret itself) and a `re` (no global
+ * flag — the global flag is added on demand for redaction).
+ */
+
+export interface SecretPattern {
+	name: string;
+	re: RegExp;
+}
+
+// Patterns are deliberately conservative to limit false positives. The user
+// still confirms interactively, so a rare false positive is cheap.
+export const SECRET_PATTERNS: SecretPattern[] = [
+	{ name: "aws-access-key-id", re: /\bAKIA[0-9A-Z]{16}\b/ },
+	{ name: "gitlab-pat", re: /\bglpat-[0-9A-Za-z_-]{20,}\b/ },
+	{ name: "github-pat", re: /\bghp_[0-9A-Za-z]{36}\b/ },
+	{ name: "github-fine-grained-pat", re: /\bgithub_pat_[0-9A-Za-z_]{22,}\b/ },
+	{ name: "slack-token", re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
+	{ name: "private-key-block", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
+	{ name: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/ },
+	// Generic "secret: value" / "token=value" assignments with a non-trivial value.
+	{ name: "generic-credential", re: /\b(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*["']?[^\s"']{8,}["']?/i },
+];
+
+/** Return the names of secret patterns found in `text` (empty if none). */
+export function scanSecrets(text: string): string[] {
+	if (!text) return [];
+	const hits: string[] = [];
+	for (const p of SECRET_PATTERNS) {
+		// Use a non-stateful copy (no global flag) to avoid lastIndex surprises.
+		if (p.re.test(text)) hits.push(p.name);
+	}
+	return hits;
+}
+
+/** Replace every secret occurrence with a labelled placeholder. */
+export function redact(text: string): string {
+	if (!text) return text;
+	let out = text;
+	for (const p of SECRET_PATTERNS) {
+		const g = new RegExp(p.re.source, p.re.flags.includes("g") ? p.re.flags : `${p.re.flags}g`);
+		out = out.replace(g, `«REDACTED:${p.name}»`);
+	}
+	return out;
+}