pregate secret scan drops source context and flags code expressions #3211

In gstack-pregate, addedLines flattens the branch diff into plain text before invoking gstack-redact with --from-file. The scanner consequently loses each line sourcePath and treats JS object properties whose values are runtime credential reads as secret assignments, despite isSourceExpression being designed to exclude code expressions when source context exists.

Reproduced on 2026-10-16 while validating swxtchio/swx-abbe#1412 round 3: gstack-pregate reported 14 MEDIUM env.kv findings on credential-field code and synthetic fixtures. The source-aware command git diff --no-color --unified=0 --diff-filter=ACMR origin/main | gstack-redact --repo-visibility private --json reported no secret findings (only a PII-format UUID). The pre-gate findings are therefore scanner false positives, not a reason to downgrade or suppress actual secrets.

Please preserve file/source context for added lines when calling gstack-redact, or scan per source file so the code-expression validator can run. Reproduction command: ~/.claude/skills/gstack/bin/gstack-pregate --allow-repo-commands --only secrets.