4.0.1: public redaction helpers, ReDoS validator stall, phantom ban, singleton resets, and path-level CI gates #96

Follow-ups found by consumers and by adversarial passes within a day of 4.0.0 on a green suite.

• The grammar redactor was reachable only through a private module; the SaaS ingest path needs it as public API.
• A catastrophic custom pattern stalled validation 40 seconds per pattern at config, decorator and dynamic-rule time before the structural reason was returned; the verdict also flipped under CPU load, and a killed parent left a probe child burning a core.
• A ban refused by the self-DoS guard was still answered 403 "IP has been banned" and logged as applied.
• reset_global_state() on the ban and security headers singletons kept a closed redis_handler; the rate limiter reset kept agent_handler.
• No gate caught a 419 second test, a load-flipped timing verdict, or the published adapter running on a new core.
• pytest 9.1.1 drops nested conftest fixtures on interleaved file arguments (9.1.1: nested conftest fixtures are not found when file arguments interleave a nested directory with its parent pytest-dev/pytest#14971).