fix: _is_sensitive silently drops topic notes (token-economics-of-recall.md flagged as a secret)

[edudatsuj45]

Problem

The generic keyword patterns in _SENSITIVE_PATTERNS flag any filename containing token/secret/password/credential as a standalone word — so prose documents whose descriptive slug merely mentions the topic are silently dropped from the graph:

Filename	Current	Reality
token-economics-of-recall.md	skipped as sensitive	a note about LLM token costs
password-policy-discussion.md	skipped as sensitive	a design discussion

This is the remaining failure class after the #436 → #718 → #920 lineage. Hit in the wild: an Obsidian-style memory vault where a note on token economics vanished from the graph with no visible warning (skipped_sensitive is returned but nothing surfaces it — exactly the silent-data-loss failure mode described in #718's closing observation).

Fix

Split the two generic keyword patterns out of _SENSITIVE_PATTERNS and only count a match when the keyword is load-bearing in the filename:

• the keyword ends the stem (api_token.txt, oauth_token.json, github-personal-access-token.txt) — secret stores name their contents, and the content noun is the head of the compound, which comes last in English; or
• the stem has ≤ 2 words (token.txt, token_config.yaml, secret_handler.txt).

A keyword buried mid-phrase in a ≥ 3-word slug is a topic word, not a credential store. The specific patterns (.pem/.env/id_rsa/.netrc/aws_credentials/_SENSITIVE_DIRS) are unchanged and still always apply.

The end-of-stem check runs before word counting, so multi-word keywords survive their own separator: my_private_key.txt is still flagged even though splitting on _ would break private_key apart. Leading dots are stripped before stem extraction so dotfiles like .token keep their keyword.

Behavior table

Filename	Before	After
token-economics-of-recall.md	flagged ❌	clean ✅
password-policy-discussion.md	flagged ❌	clean ✅
api_token.txt / oauth_token.json (#920)	flagged	flagged
token.txt / tokens.txt / .token	flagged	flagged
token_config.yaml / secret_handler.txt (#920)	flagged	flagged
github-personal-access-token.txt	flagged	flagged
my_private_key.txt	flagged	flagged
passwords.py / credentials.json	flagged	flagged
tokenizer.py / tokenize.py (#718)	clean	clean
.env / server.pem / id_rsa / .ssh/…	flagged	flagged

Tests

All 13 existing test_sensitive_* contracts pass unchanged; adds 6 regression tests covering the topic-slug false positive plus the dotfile, plural, end-of-long-name, and multi-word-keyword edge cases.

tests/test_detect.py: 19 passed (sensitive subset)
tests/test_detect.py: 109 passed, 6 failed* , 1 skipped
* pre-existing WinError 1314 symlink-privilege failures on Windows without Developer Mode, unrelated to this change

🤖 Generated with Claude Code

[safishamsi]

Landed in a8dbbe5. Generic keywords (token/secret/password) now only fire when the keyword ends the filename stem or the stem is ≤2 words. Specific patterns (.env/.pem/id_rsa etc.) remain unconditional. token-economics-of-recall.md passes through; tokens.txt is still caught. Thanks!