Scope + sanitize the Atlas corpus for external builders

[jpr5]

Summary

Scopes + sanitizes the Atlas harvest corpus so agent-facing curated knowledge is safe + relevant for external builders. Three layers:

1. Env/private/session sanitizer (sanitize-env-refs.ts adapter pass): machine-local paths → repo-relative or <local-path> (home-root files, /src tails, separator-preceded CONFIG=//path:/cwd=, and placeholder-abutting paths); session UUIDs stripped; private Notion ids/URLs (.so/.com, multi-segment, context-anchored /p/, multi-label subdomains) → <notion-page-link>; internal Slack allowlist; railway hosts+projects (case-insensitive, multi-label, uniform left-boundary) → <internal-service>; @copilotkit.ai emails. Placeholder-safe + idempotent. Includes a github-adapter content-extraction fence-parity fix so the extracted corpus content is correctly scoped upstream of sanitization.
2. enforceAudienceRelevance gate: marks internal-ops candidates approvable=false via a shared floor predicate + rank-score floor; fail-restrictive knowledge_type coercion; dual-carrier stale-marker strip on verdict flip; whitespace-run + trailing-token-tolerant verdict parse; tightened HTTP-status pre-screen.
3. Distillation-prompt reconciliation: keep product-portable specifics, strip environment glue.

Directly addresses the machine-local paths (/proj/cpk, /Users/jpr5), private Notion refs, session ids, and internal-ops-relevance that were leaking into corpus candidates.

Testing

Red-green for every fix; full suite 3554 passing. CR Tier-3 converged over 9+ review/confirmation rounds + a Procedure 3 audit (K=2 clean); caught + fixed 2 integration-coupling breaks mid-blitz + multiple rounds of leak/floor-escape/corruption/correctness fixes.

Spec: https://app.notion.com/p/3963aa38185281db80b8e4bf73de0ea5

Follow-ups (non-blocking; Atlas not wired on in prod — S21 deferred)

• Dry-run the audience gate over the existing corpus + tune the relevance judge/pre-screen before wiring on (OQ3).
• Sanitizer regex long-tail (non-leak content-fidelity, tune-before-wire): NOTION_MARKER hyphen-boundary over-fire; notion.so/<33-hex-run> non-collapse.
• Pre-existing (bucket-c, out of subject): llm.ts embed element-type cast; adapter date-format validation; canonicalize claimSlug empty-title collision; harvest-cli buildArtifactCandidates RunStore threading.
• episodic adapter provenance.source is now <local-path>.