update QoL and ai integration

TODO.md

@@ -19,8 +19,9 @@ editing are already implemented.
   redaction counts, and deletion/export controls without persisting raw diffs.
 - Improve semantic near-duplicate detection across existing GitHub comments
   and local findings, while retaining deterministic exact fingerprints.
-- Add configurable sensitive-path policy sets and a per-run file picker before
-  confirmation.
+- Add named sensitive-path policy sets and a manual per-run file picker before
+  confirmation; the current configurable sensitive-path list and bounded
+  automatic thread-context requests cover the default focused flow.
 - Add recorded provider event fixtures and adversarial prompt-injection,
   ANSI/OSC, path traversal, stale-head, oversized-output, and tool-attempt
   integration tests.