Release transformabl-core 0.4.1: ReDoS fix + redactPii overlap corruption + PII-scan truncation loudness

[davidcrowe]

Goal

Cut transformabl-core 0.4.1 as a security release, then bump the transformabl facade so consumers can actually receive it. Production (gatewaystack-connect) runs transformabl-core@0.4.0 on every governed call and cannot upgrade until this ships.

Included fixes

1. ReDoS in the email PII regex — bound the quantifiers (PR fix(transformabl-core): ReDoS in email PII regex + scan cap (0.4.1) #30, branch fix/transformabl-redos). Security review verdict: the fix is correct, all sibling patterns are already bounded, no remaining super-linear pattern. Merge fix(transformabl-core): ReDoS in email PII regex + scan cap (0.4.1) #30 as the base.
2. redactPii overlap corruption (H4) — src/redact.ts:30-52 replaces matches by descending original offset; when an inner overlapping match is replaced first, the outer match's stale end slices the wrong point and trailing PII digits survive (reachable in placeholder/remove modes). fix(transformabl-core): ReDoS in email PII regex + scan cap (0.4.1) #30's new recognizers (us_bank_number ⊇ npi/ssn digit runs) make overlaps routine. Fix: merge overlapping spans into maximal intervals before substitution. Ship in the same 0.4.1 — fix(transformabl-core): ReDoS in email PII regex + scan cap (0.4.1) #30 is what makes it exploitable.
3. Silent PII-scan truncation (M2) — src/detect.ts:149-151 caps scanning at 512KB with no signal (gateway body limit is 2MB), so PII placed past the cap flows through unredacted and unlogged. Violates "fail-open must be loud." Fix: add a scanTruncated flag to TransformResult; fix the now-false comment in normalize.ts.

After publish

• Bump the transformabl facade's core range from ^0.3.0 (which can NEVER resolve 0.4.x) to ^0.4.1, republish the facade.
• Coordinate the prod lockfile bump (gatewaystack-connect issue for the stale pins).

Acceptance

• transformabl-core 0.4.1 on npm; facade range resolves it.
• Overlapping-match test: redacted output contains no substring of any original match value.

• 512KB input signals truncation.