Contributor-reported fixes: paths with spaces, redactor gaps, safe Slack (#476)

cuts, jsonb-safe serialization, CAS promotion, mid-run files, IME Enter Seven first-principles fixes for reported bugs, one commit per bug. bench:memory and the twin-instance script broke under any directory containing a space (new URL(...).pathname keeps percent-escapes) — use fileURLToPath everywhere a file URL becomes a path (#77). The audit redactor missed base64url-shaped (JWT-alphabet) secrets and its --with-token rule replaced the match with itself, a literal no-op (#80). Slack section splitting, clip, and inlineCode cut with bare slice, bisecting emoji surrogate pairs, <url|label> entities, and format runs — one safe-boundary cutter now backs all three (#82). The Postgres-backed durable map JSON.stringifies into jsonb, which rejects NULs and lone surrogates the system's own truncation helpers manufacture — sanitize at the serialization boundary (#62). Scratch-memory promotion wrote back with a blind replace, reverting any edit that landed during its model call — the write is now compare-and-set against the revision read at the start (#79). Steering a live run with a captionless file dropped the file while reporting steered:true — wakes now carry attached file names so the file is announced to the run (#89). And the Enter that confirms an IME composition (Japanese/Chinese/Korean) no longer submits the half-composed message (#140, issue #225).  toyoshi

**Deployment notes**

Batch of small fixes; mostly behavior-neutral (fileURLToPath, base64url secret masking, Slack
safe-cut splitter, durable-map jsonb tweak).
Secret masking now redacts base64url tokens and --with-token payloads — audit lines get MORE
redaction; any org tooling that parsed raw tokens out of audit logs (unlikely, undesirable) loses
them.
Slack messages near the 2900-unit boundary split at slightly different points; cosmetic.

<!-- codesmith:footer -->
---
<a href="https://app.blacksmith.sh/yc-software/codesmith/qm/pr/391"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1789237844&installation_model_id=19911&pr_number=391&repository=yc-software%2Fqm&return_to=https%3A%2F%2Fgithub.com%2Fyc-software%2Fqm%2Fpull%2F391&signature=c27a6ff0974722bac9130ebc317938623848f6112d26d6c5c75bd474dc19e8b2"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->