Bug: Rundoc.filter_sensitive (and other post processing) can produce invalid markdown by messing with closing fences

[schneems]

    ```term
    :::-- print.erb Ensure app responds: <% curl_with_retry %>
    :::>- background.start("heroku logs --tail", name: "logs", timeout: 300, wait: "heroku[")
    :::-- print.erb Simulate one request: <% curl_with_retry %>
    :::-- background.wait(name: "logs", wait: "heroku[router]", timeout: 20)
    :::-> background.stop(name: "logs")

Produced this output:

    ```term
    $ heroku logs --tail
    2026-04-29T20:46:23.417804+00:00 app[api]: Release v1 created by user developer@example.com2026-04-29T20:46:23.417804+00:00 app[api]: Initial release by user developer@example.com2026-04-29T20:46:23.698020+00:00 app[api]: Enable Logplex by user developer@example.com2026-04-29T20:46:23.698020+00:00 app[api]: Release v2 created by user developer@example.com2026-04-29T20:46:26.000000+00:00 app[api]: Build started by user developer@example.com2026-04-29T20:46:42.147970+00:00 app[api]: Release v3 created by user developer@example.com2026-04-29T20:46:42.147970+00:00 app[api]: Deploy 80a80b7a by user developer@example.com2026-04-29T20:46:42.165854+00:00 app[api]: Scaled to web@1:Basic by user developer@example.com2026-04-29T20:46:44.180027+00:00 heroku[web.1]: Starting process with command `gunicorn --config gunicorn.conf.py gettingstarted.wsgi`
    2026-04-29T20:46:44.978562+00:00 app[web.1]: Python buildpack: Detected 512 MB available memory and 8 CPU cores.
    2026-04-29T20:46:44.978661+00:00 app[web.1]: Python buildpack: Defaulting WEB_CONCURRENCY to 2 based on the available memory.
    2026-04-29T20:46:45.000000+00:00 app[api]: Build succeeded
    2026-04-29T20:46:45.226881+00:00 app[web.1]: WARNING:root:No DATABASE_URL environment variable set, and so no databases setup
    2026-04-29T20:46:45.243870+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [2] [INFO] Starting gunicorn 25.3.0
    2026-04-29T20:46:45.244015+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [2] [INFO] Listening at:  (2)
    2026-04-29T20:46:45.244044+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [2] [INFO] Using worker: gthread
    2026-04-29T20:46:45.246696+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [8] [INFO] Booting worker with pid: 8
    2026-04-29T20:46:45.254835+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [9] [INFO] Booting worker with pid: 9
    2026-04-29T20:46:45.317617+00:00 app[web.1]: [2026-04-29 20:46:45 +0000] [2] [INFO] Control socket listening at /app/.gunicorn/gunicorn.ctl
    2026-04-29T20:46:45.447544+00:00 heroku[web.1]: State changed from starting to up
    2026-04-29T20:46:49.018653+00:00 app[web.1]: gunicorn method=GET path="/" status=200 duration=10ms request_id=7967c239-2bac-f27b-55aa-cd3665ee9533 fwd="123.456.789.0" user_agent="curl/8.7.1"
    2026-04-29T20:46:49.018762+00:00 heroku[router]: at=info method=GET path="/" host=evening-fortress-86814-563c90d9c3f5.herokuapp.com request_id=7967c239-2bac-f27b-55aa-cd3665ee9533 fwd="123.456.789.0" dyno=web.1 connect=1ms service=11ms status=200 bytes=9585 protocol=http1.1 tls=false
    2026-04-29T20:46:50.128979+00:00 app[api]: Log session created by user developer@example.com```
    <!-- STOP. This document is autogenerated. Do not manually modify. See the top of the doc for more details. -->        

Which is wrong. Notice that there's no newline before the ending tripple backticks...therefore they're not recognized as being a closing fence.

This is happening because this code:

email = ENV['HEROKU_EMAIL'] || `heroku auth:whoami`
# ...

Rundoc.configure do |config|
  # Remove personal info from doc
  config.filter_sensitive(email => "developer@example.com")

The heroku auth:whoami includes a trailing newline. so the gsub in the filter_sensitive accidentally removes the newline after the developer email which comes right before the tripple backticks.