fix: close incremental promotion review findings

[BeforeLights]

Summary

• assert exact normalized telemetry error keys/messages without leaking proxy causes
• make Terraform safety scanning ignore comments, heredocs, and string braces
• require CI policy evidence in actual run command values
• add focused regression fixtures for all three review items

This is a follow-up promotion-gate fix PR. It targets dev; CodeRabbit is intentionally not requested here. The existing promotion PR #20 remains the single reviewed promotion PR.

Verification

• node --test tools/repo-cli/test/terraform-safety.test.mjs tools/repo-cli/test/ci-policy.test.mjs tools/repo-cli/test/aws-infrastructure.test.mjs packages/telemetry/test/telemetry-v1.test.mjs
• corepack pnpm format:check
• corepack pnpm typecheck
• corepack pnpm lint

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 814088d0-4787-4c71-a994-3bb797288c88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}