Fix email redaction before trailing periods

[cursor]

Summary

• Fix scp_mask_secrets so emails followed by a sentence-ending period are redacted instead of leaked.
• Add a regression test for alice@example.com. punctuation handling.
• Sync the vendored MCP contract hash expectation so the test suite reflects the current contract file.

Bug and Impact

The recent linear email masker treated a trailing . as part of the domain, then rejected the whole span because it ended in an empty label. Common prose like Contact alice@example.com. was returned unredacted, leaking PII through the LLM06 masking path.

Root Cause

The domain scanner consumed every . while scanning, including punctuation after the TLD. Validation later rejected example.com. as an invalid domain instead of masking example.com and leaving the period outside the email span.

Fix

Stop scanning the domain when a . is not followed by a valid domain-label character, preserving the punctuation while redacting the email span.

Validation

• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_mask_email_before_sentence_period
• PYTHONPATH=src python3 -m pytest
• Focused correctness/security review agents reported no findings.