sync: upstream convergence 2026-03-02

[brunoclz]

Summary

• Automated sync from upstream private repo
• All open-core files stripped (pattern_service.py + 18 pattern queries)
• Secret scan passed

Verification

• CI passes
• No private files leaked
• Diff reviewed

Generated by scripts/sync-public.sh

[github-actions]

AI PR Governor bloqueou esta PR no preflight.\n\n- decision: blocked_prompt_injection_signal\n- reasons: ["blocked_prompt_injection_signal","blocked_too_many_changed_files","blocked_total_churn_threshold","blocked_sensitive_path_denylist","blocked_outside_low_risk_allowlist"]\n\nNenhum merge automático será feito neste ciclo.