refactor: compose shared sanitizing gate logic #3174

Situation

PR #3173 for #3168 introduces four JavaScript sanitizing detectors. On its reviewed head a13283d, SonarCloud reports 257 duplicated lines out of 735 new lines (34.965986394557824%). Both independent code reviewers and the architect confirmed duplicated runGate and alias/metric/diagnostic helpers across the detectors.

The user explicitly requested composition, then instructed merging #3173 and continuing this work separately. This issue tracks that separate work; it is not a replacement or fourth phase of epic #3166. References #3166, #3168 and #3173.

Verified evidence

• Source at a13283d: scripts/sanitizing_file_layout.mjs:26, scripts/sanitizing_tauri_edge.mjs:36, scripts/sanitizing_global_state.mjs:33 and scripts/sanitizing_process_env.mjs:33 have the repeated runGate implementation. Alias support starts at line5 in each.
• Sonar API: api/measures/component for mblua_AgentsCommander, pullRequest3173, reports new_duplicated_lines_density34.965986394557824, new_duplicated_lines257 and new_lines735.
• Canonical evidence: D:/0_repos/AgentsCommander_iac/.ac/plans/3166-sanitizing-ci-gates/P02-sonar-duplication-a13283d6-20261022.json and P02-duplication-architect-assessment-20261022.md.
• Atomic alias false PASS AC-3168-001 was corrected in a13283d with AtomicUsize/cfgAtomicU64 regressions; both independent reviews approved that exact head. Preserve that fix.
• Existing defect AC-3168-002 remains the stable duplication record in .ac/project-shared/3166-sanitizing-ci-gates/code-errors/.

Required result

Compose the shared detector logic with the minimum necessary shared JavaScript support. Physically remove repeated implementations while preserving each detector's policies, exports, diagnostics/order, counters, errors, snapshot/HEAD checks and strict new-file/new-command rules. The architect owns the final structure; the previous shared-support proposal is evidence, not a frozen implementation decision.

Acceptance

1. The repeated implementations are shared and actual source duplication is reduced; merging the earlier debt into main is not itself the fix.
2. Existing self command and direct runGate(snapshot) entry points remain compatible. Preserve Atomic alias regressions and the four detector results, including ambiguity warnings and error behavior.
3. Focused equivalence/control evidence and both independent exact-head reviews support the composed implementation. Reuse intact evidence with an explicit reason.
4. Run relevant JavaScript/gate validation and Sonar on the follow-up PR head; meet the unchanged duplication quality condition. Do not suppress/classify findings manually, change thresholds/exclusions or manufacture superficial source differences.
5. Do not force ci:full for this JavaScript-only change. Preserve native workflow tiers and repository rules; document actual execution and expected tier skips accurately.

Scope and exclusions

Four scripts/sanitizing_{file_layout,tauri_edge,global_state,process_env}.mjs detectors, minimal shared support and existing sanitizing tests as needed by the reviewed plan. No Rust/TypeScript/application/runtime changes, dependency/lock/version changes, cleanup of unrelated optional findings, new workflows, app build or release.

Continue from current synchronized main after #3173 merges, with this issue's own branch and PR. Keep the original epic phase identities intact. Technical delta score18/100 (raw42), original delivery34/100; table and ceremony exclusions are in P02-composition-delta-score-20261022.md and issue3168 comment6345284377.