feat(ai): configurable sensitive-term redaction for synced content mirrors

Configurable sensitive-term redaction for synced content mirrors

The git-tracked content mirrors (resources/content/ + resources/content/archive/) are public and can capture sensitive terms (commercial-partner names, external contributor handles) that must never appear in public artifacts (§critical_gates#9). This adds a configurable redaction migration to scrub such terms from the existing mirrors, and seeds the redactor the sync-writer guard will reuse.

Approach

• A one-time, argv/config-driven redaction migration in ai/scripts/migrations/ — no hardcoded sensitive term in the tracked source (the deny-pairs are passed at invocation / sourced from gitignored config). It reads each affected mirror, applies ordered from→to deny-pairs (longest/handle terms first), and writes back with capability-framing placeholders.
• The redactor is a pure, testable function so the sync-writer guard (sibling slice) can reuse it to prevent re-introduction on the next sync.

Acceptance Criteria

• After the migration, a repo-wide grep for the configured term across resources/content/ returns 0 hits.
• The migration script + any tracked config default are themselves name-clean (argv/gitignored-config driven; the template default is empty).
• Capability-framing placeholders (external handle → a generic contributor; partner term → a generic client/deployment).
• Pure redactor unit-tested (ordered deny-pairs, case handling, fail-safe on non-string input).

Part of the gate-9 swarm remediation — surface D (synced mirrors). Sibling: surface E (sync-writer guard, reuses the redactor).