4ea7c882fc
Extend the two salvaged invariant tests instead of adding more: the `.profile` negative now covers `?.`, `().` and `].` access (the lookbehind was widened from `[A-Za-z0-9_]` to `[\w)\]?]` during salvage), the positive covers a bare `.profile` token, and the sudo positive covers the `-S` (read password from stdin) form, which the gateway's own masked password prompt relies on.