fix(gateway): close remaining redaction boundaries

[dmoliveira]

Summary

• Fail closed when a contextual detector still matches after a replacement that leaves the value unchanged.
• Bound provider fallback session-ID extraction by the configured message limit and run it inside the guarded finalizer path.
• Preserve direct system prompt strings as mutable while scanning system objects from root-scan mode.

Validation Evidence

• npm test (968 passing)
• npm run lint
• make validate
• pre-commit run --all-files
• git diff --check
• Final static review: no blockers for this slice.

Follow-up

• Custom JavaScript regex execution isolation is tracked separately in Codememory task_157.