fix: keep JWT privacy scanning within the release gate

[Yuki9814]

Maintainer problem

The immutable v0.5.0 tag reached the release workflow, where the near-2,000,000-character repeated-JWT-prefix regression took 2.14 seconds against its 2.00-second Ubuntu budget. The release correctly stopped before publishing assets.

Change

• replace bounded-regex JWT matching with one monotonic, delimiter-driven pass and a fixed 1,028-entry header window
• retain the existing word-boundary and segment-length contract, including fourth segments and chained tokens
• coalesce chained-token masks without exposing later segments or promoting incomplete nested headers to findings
• bump the unreleased fix to 0.5.1; the existing v0.5.0 tag is untouched and will not be reused

Evidence and verification

• lint
• 134 unit/component tests
• production build and Pages asset-path verification
• offline dependency audit: 0 vulnerabilities
• 13 Chromium E2E tests
• independent review: no P0/P1/P2; 10,800 old-regex compatibility cases matched
• near-2M adversarial p95: repeated prefixes 59.62 ms, dense separators 20.77 ms, dense nested prefixes 162.75 ms
• security and local-first boundary reviewed

Remote CI must prove the online dependency audit and Ubuntu timing gate before merge.

Risk and rollback

No schema, import, browser-storage, CSP, dependency, or network behavior changes. Revert this commit to restore v0.5.0 matching behavior; do not move or reuse the v0.5.0 tag.

Part of #13. External maintainer evidence remains N=0, so #13 stays open.