Sensitive filenames disguised with Unicode look-alike letters are now caught.
What's wrong with this entry?
A file named with a dotless i, a long s, a Kelvin sign or an ff/fi ligature no longer slips past the checks that classify a path as sensitive. Paths are normalised through a NFKD plus case round trip with invisible characters stripped, and tracked sensitive files get their own verdict, sensitive_tracked. The sync worker's filename-safety checks reject these look-alikes outright.
- The set of confusables differs by platform: Windows and WSL use one list, macOS adds ß.
- Runs on every classification, with no flag.
sensitive_tracked
Strings lifted out of the shipped bundle, so the claim above can be checked against them.