SCANNER_PROBE_RE: consolidate 2026-07-17 46-path sweep (Block M)

2026-07-17 15:24-15:36 UTC: single automated recon sweep hit 46 distinct paths, all genuine-bad-route/unauthenticated, none currently silent-tiered. db-pluto-cc pulled full list (read-only, no app changes): /.flaskenv (already fixed PLUTO-601/06f14a2) /.gcp/credentials.json /.gcp/service-account.json /.hcloud.toml /.linode-cli /.secrets /.streamlit/secrets.toml /root/.streamlit/secrets.toml /api/settings /app.bundle.js /app.js /appsettings.Development.json /appsettings.Production.json /assets/app.js /assets/index.js /build/static/js/main.js /bundle.js /cdp_api_key.json /chunk.js /conf/settings.json /config /config.js /config.toml /debug/vars /dist/app.js /dist/bundle.js /dist/main.js /ecosystem.config.js /gcp-service-account.json /google-cloud-key.json /index.js /js/app.js /js/main.js /main.bundle.js /main.js /server.js /settings.js /settings.json /static/js/app.js /static/js/bundle.js /static/js/main.js /vendor.js /wp-config.php.old /wp-config.php.save /wp-config.php.txt /wp-config.php~ Families: (a) generic JS-bundle filename enumeration under /, /js/, /static/js/, /dist/, /build/static/js/, /assets/ (main.js/app.js/bundle.js/vendor.js/chunk.js/index.js/server.js + combos) - Next.js never serves bare paths like this (real assets are hashed under /_next/static/chunks/*); (b) cloud-cred JSON/dotdir variants not matching existing Block A/B (.gcp dotdir isn't in the A dotdir list which has gcloud not gcp; filename variants service-account.json/gcp-service-account.json/google-cloud-key.json don't match B's exact-word-only json filenames); (c) wp-config.php backup-suffix variants (.old/.save/.txt/~) - existing rules ban bare .php but not these compound suffixes; (d) new singles: /debug/vars (Go pprof/expvar convention), /.secrets, /.streamlit/secrets.toml + /root/ variant, /.hcloud.toml, /.linode-cli, /ecosystem.config.js (PM2), /conf/settings.json, /api/settings, /config, /config.js, /config.toml, /appsettings.Development.json + .Production.json (ASP.NET). Per pluto-scanner-probe-canonical discipline: this sweep IS the frequency evidence (46-path single coordinated recon run) that justifies broadening even the app-plausible-sounding ones (/config, /api/settings, /debug/vars) - PROVIDED audit collision-proofs each new alt against Pluto's actual route manifest (0 collision) before merge, per the Block K/L (PLUTO-462/463) precedent. Draft consolidated alt block, audit collision-proofs, then publish to fleet (mars/venus inherit per pluto-scanner-probe-canonical ownership).