Security: close remaining broker, cloud-session, and workspace redaction gaps

[willwashburn]

Problem

Credential material still reaches output surfaces that are routinely captured
in terminal transcripts, logs, and support dumps:

• RELAY_BROKER_API_KEY can reach broker log/dump paths.
• Published agent-relay cloud session --json prints the cloud access token in
  plaintext.
• Published agent-relay workspace active can include the workspace key in
  error output.

Rotation is not sufficient containment for these paths: creating the next
session reproduces the disclosure.

Relationship to #1379 / #1380

#1380 contains source-side masking for cloud-session and workspace output, but
the current published 11.3.0 artifact still leaks. The broker API-key log/dump
path also needs explicit coverage. This issue tracks the end-to-end published
contract across all three surfaces; do not treat a source-only fix as shipped
containment.

No live credential values should be pasted into this issue, tests, or review
artifacts.

Expected behavior

Default output, errors, structured JSON, logs, and diagnostic dumps never
contain full broker API keys, cloud access tokens, or workspace keys. Revealing
a secret requires an explicit command/flag and a warning appropriate to the
sink.

Acceptance criteria

• Redact RELAY_BROKER_API_KEY from every log and diagnostic-dump path.
• Keep cloud session --json masked by default; require an explicit reveal
  action for the raw cloud token.
• Redact workspace keys from workspace active errors as well as success
  output.
• Cover non-Error failures and embedded credentials inside larger strings.
• Test both source execution and the packed/published CLI artifact so a build
  or packaging gap cannot reintroduce plaintext output.
• Verify the fixed version from an installed tarball before considering the
  exposure shipped-closed.