fix(health): rules that fired in the wrong language, and files never scanned at all #5614

fix(health): a real password went unreported because another field sat to its left

fix(health): "credential rules stay unconstrained" was too coarse for docs

test(ship-path): pin the merge chain's Anthropic surface, after a lapsed bill blocked every merge

fix(health): rules that fired in the wrong language, and files never scanned at all