fix(scan): reduce context-free findings

[mrprecioustech]

Summary

• reduce false positives from static installer pipelines, normal lifecycle scripts, HTML sanitizers, regex-like code, and temp-path strings
• serialize JSON-LD safely before injecting it into script elements
• remove eval and predictable /tmp coordination from Git hooks
• add regressions for the narrowed rules

Validation

• targeted Node checks for JSON serialization and regex scoping

Full Vitest could not run locally because workspace dependencies are not installed.

[github-actions]

ThreatCrush Security Scan

11 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 5 | LOW: 5

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:50
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:96
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:100
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	PRD.md:268
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:47
LOW	secret-aws-access-key	scripts/smoke-test.sh:112

Snippets are redacted; ThreatCrush never prints matched credential material.