docs+test: round-2 incident response — Google API key format scrub

security: fail-closed on secret extraction and env var leakage

fix: ruff lint — import sorting, unused imports, line length, naming

fix(security): strip punctuation before slashes in URL normalization

fix(security): validate injection tier names, normalize URLs

feat(security): add output validation gate (PII, URL, blocklist)