Down-tier the AI-assistant-config + shell-history scanner family

Single sweep 2026-09-05T22:58:14Z, 93 distinct probe paths recovered from Vercel runtime logs (the applog DM elided 34 of 42). Executing tierForNotFound() over the recovered set leaves 30 paths at warn/navigation: AI-coding-assistant config dotdirs (.cursor/.windsurf/.codeium/.continue), AI/MCP config JSON basenames at root (mcp.json, mcp_config.json, llm_config.json, ai_config.json, openai.json, claude_desktop_config.json), cred-JSON basenames outside Block B word-set (google/service_account/auth/tokens/keys/api_keys), CLI history dotfiles (.python_history/.mysql_history/.psql_history/.node_repl_history), shell rc/profile dotfiles (.zshrc/.profile/.bash_profile/.zprofile), and .htaccess. Add as Block U with the usual constraints: bare .json and bare .txt stay BANNED, dotfile arms use any-segment anchoring, app-plausible words stay whole-path exact.