fix(redact): split OPF spans that cross a batch separator instead of dropping them

RedactBatch joins every leaf into one opf input separated by \x1e. The model reads that as continuous text and can return one entity spanning two leaves ("Claude Code" + "Alice Johnson ..." read as "Code Alice Johnson"). partitionIndex treated such a span as invalid and dropped it, so neither leaf was redacted, and the pre-push rewrite still stamped Entire-OPF-Applied.

splitBatchSpan maps a span onto every input it overlaps, so each leaf gets its own piece. At worst a word next to the boundary is redacted too. Spans past the last input are now clipped to the batch length.