[sds]

Fix the sources of all 10 open code-scanning alerts (#1–#10). File reads now treat pipe-prefixed paths as filenames, the flagged regular expressions avoid overlapping backtracking, branch discovery uses Git's ref output instead of parsing detached-HEAD display text, and the test workflow explicitly limits its token to contents: read. The remaining action version tags are pinned to their resolved commit SHAs to satisfy repository policy.

Regression tests cover literal and missing pipe-prefixed files, real JSON/XML parse failures, all six affected hook-output parsers, long malformed inputs, concurrency arithmetic, acronym conversion, and detached or ambiguous branch names.

Validation:

• bundle exec ruby script/parallel_rspec.rb: 2,202 examples passed with 100% line coverage (3,844/3,844 lines).
• bundle exec overcommit --run: passed.
• The adversarial regex inputs also complete within two seconds on Ruby 2.6.10, without relying on newer Ruby regex caching.

GitHub validation on commit 6ad65d2a:

• All 24 PR checks passed, including the complete Linux/Windows matrix across Ruby 3.3, 3.4, and 4.0 and the combined 100% coverage gate.
• Ruby, Actions, and JavaScript/TypeScript CodeQL analyses each report zero findings; the PR has zero open code-scanning alerts.