test(ui): cover miner-commands redaction and action branches

[philluiz2323]

Summary

• Add dedicated apps/loopover-ui/src/lib/miner-commands.test.ts covering sanitizeMinerCommand (each forbidden term=value / term: value category, passthrough, name-token non-corruption, and local-path redaction) and every buildMinerCommandActions state branch.
• Export sanitizeMinerCommand so the redaction contract can be unit-tested directly (it was previously private and only reached indirectly via miner-panel.test.tsx).

Closes #8677

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm --workspace @loopover/ui run test -- src/lib/miner-commands.test.ts (9 passed)
• npm run actionlint — not applicable
• npm run typecheck — not applicable (UI test/export only)
• npm run test:coverage — not applicable (apps/** excluded from codecov/patch; UI vitest coverage exercised above)
• npm run test:workers — not applicable
• npm run build:mcp — not applicable
• npm run test:mcp-pack — not applicable
• npm run ui:openapi:check — not applicable
• npm run ui:lint — skipped locally; no formatting-sensitive UI component changes beyond a one-line export
• npm run ui:typecheck — skipped locally; export is a visibility change only
• npm run ui:build — not applicable for this test-only PR
• npm audit --audit-level=moderate — not applicable
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Test-only / one-line export PR. Local UI vitest covers the new file; full UI lint/typecheck/build left to CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — no visible UI change (test coverage + export only).

Notes

• Duplicate-checked open PRs for test(ui): miner-commands.ts's sensitive-term redaction logic has zero direct test coverage #8677 before opening.
• Second of two open PRs for this account (2-PR threshold).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 LoopOver is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[loopover-orb]

This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included.