Fix open Greptile P1 review items - #10

Summary

Addresses the six Greptile P1 items still open on main after PRs #2-#4 (PR #7 had no Greptile review):

• Judge deadlock: InputPipeline._maybe_judge now uses run_coroutine_sync instead of run_coroutine_threadsafe on the caller loop thread
• Pipe evasion vs shell pipes: removed unconditional | strip; keep alpha|alpha plus letter|space and space|letter evasion passes while preserving ls | grep
• SSN false positives: dropped redundant ssn_compact and reject invalid SSN area codes (000/666/9xx) in the main ssn pattern
• Secrets sanitize: merge overlapping generic spans before redaction
• Base64 decode cap: iter_base64_blobs skips decoded payloads over 10KB (matches normalize)
• PyPI publish: uv publish --check-url so release re-runs skip already-uploaded versions

Test plan

• make check-ci green locally (635 tests)
• New coverage: asyncio bridge, pipe evasion/shell pipe, overlapping secrets, oversized base64, SSN area validation
• CI green on PR