P0: .provignore patterns never wired into production redactor

[mattfogel]

Summary

Both production Redactor::new() instances skip the .provignore user-pattern source. R4's promise that user-defined secret patterns are caught at write time is broken, and the pre-push gate's R6 backstop misses them too — both layers of the defense-in-depth model are inert for any user-defined pattern.

Severity

P0 — exploitable secret-leak path. Confidence 100 (verified by both security and adversarial reviewers in the catch-up review of #18-#22).

Evidence

• Write-time call site: crates/prov-cli/src/commands/hook.rs:168 — Redactor::new() with no .with_provignore(...).
• Pre-push call site: crates/prov-cli/src/commands/hook.rs (around the handle_pre_push body, post fix(privacy,sync): U7/U8 review small fixes #23 line shift) — same.
• The parser, scanner, and detector kind for .provignore are fully implemented and unit-tested in crates/prov-core/src/redactor/provignore.rs, but with_provignore and ProvIgnore::from_path are never called outside tests (verified via grep -rn "with_provignore\|ProvIgnore::from_path" crates/).

Acceptance criteria

• Write-time redactor reads .provignore from the repo root before each Redactor::new().
• Pre-push redactor uses the same loading.
• End-to-end test: add a .provignore rule, capture a turn containing the pattern, assert the captured note shows [REDACTED:...].
• End-to-end test: same pattern in an already-captured note — pre-push gate blocks the push.

Reference

Catch-up review run: /tmp/compound-engineering/ce-code-review/20260502-075634-3af3d047/. See security.json (sec-001) and adversarial.json (#1).

[mattfogel]

Fixed by PR #58, merged in 34c804e. Production capture and pre-push redactors now load repo .provignore rules, with regression coverage for both paths.