[Repo Assist] test: expand TokenSanitizer coverage + refactor ExecApprovalPolicy.Save()

[github-actions]

🤖 This is an automated pull request from Repo Assist.

Summary

Two improvements in one small PR:

Task 9 — Testing Improvements: TokenSanitizerTests.cs

TokenSanitizer is a security-critical utility that redacts bearer tokens, JSON secret fields, and bare base64-url tokens from log output. It previously had only 3 tests covering the basic happy paths. This PR expands coverage to 24 tests.

New tests added:

• null and empty input → returns "" without throwing
• No-secrets input passes through unchanged
• Case and whitespace variants of Authorization: Bearer
• Token stops at whitespace (surrounding text preserved)
• All JSON keyword variants (token, secret, bearer, authorization, access_token, client_secret, BEARER_TOKEN, ...)
• JSON fields without a secret keyword are NOT redacted
• Multiple JSON secret fields in one string — all redacted
• 43-char base64-url tokens at start, middle, end of string
• 42-char tokens NOT redacted (below threshold)
• 44-char tokens NOT redacted (above threshold — word boundary anchors)
• Multiple bare tokens in one string — all redacted
• Combination test: Bearer header + JSON secret in same string

Task 5 — Coding Improvements: ExecApprovalPolicy.Save()

Save() was constructing ExecPolicyData by hand, duplicating the logic already in GetPolicyData(), and sharing the mutable _rules list reference directly instead of snapshotting it. The fix is one line:

// Before
var data = new ExecPolicyData { DefaultAction = _defaultAction, Rules = _rules };
var json = JsonSerializer.Serialize(data, _jsonOptions);

// After
var json = JsonSerializer.Serialize(GetPolicyData(), _jsonOptions);

GetPolicyData() already calls _rules.ToList() internally, so this also eliminates the shared-reference issue.

Test Status

Suite	Result
OpenClaw.Shared.Tests	✅ exit 0 (24 new tests added)
OpenClaw.Tray.Tests	✅ exit 0

Pre-existing failures (CanvasCapabilityTests.A2UIPush_*) are unrelated to this change and not present on Linux CI.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a