[Security] Implement pre-persistence secret redaction and redaction reporting

[Dyu20705]

Problem statement

CI logs and metadata may contain tokens, authorization headers, credential-bearing URLs, private endpoints, configured secret literals, or personal data. RunSift must redact sensitive values before any RunSift-owned persistent write or user-visible output.

Scope

• deterministic redaction pipeline and rule registry;
• configured literal redaction;
• common credential/token/key patterns;
• credential-bearing URL and header handling;
• redaction before reports, errors, caches, fixtures derived at runtime, datasets, or telemetry;
• redaction summary that never retains detected values;
• false-positive and partial-secret safety behavior.

Path isolation, resource limits, rendering injection, and no-execution boundaries are owned by #37.

Checklist

• Define redactor interfaces, ordering, and versioning
• Redact configured literals safely, including overlapping values
• Cover authorization headers, credential URLs, common token/key formats, and selected environment-derived secrets
• Preserve deterministic source offsets or explicit redaction mappings where required
• Apply redaction before terminal, Markdown, JSON, error, cache, dataset, or telemetry writes
• Produce counts/types/locations without storing original detected values
• Prevent secrets from entering exception messages, debug logs, snapshots, and CI artifacts
• Add positive, negative, overlap, encoded, multiline, partial-value, and false-positive tests
• Document limitations and user-supplied redaction configuration

Acceptance criteria

• No configured test secret survives any supported output or RunSift-owned persistent artifact
• Redaction reports never contain original secret values
• Redaction is deterministic and versioned
• Overlapping or repeated secret patterns do not leak partial values
• False-positive behavior is documented and regression-tested
• Failure inside redaction fails closed before unredacted persistence
• Security regression tests run locally and in CI

Dependencies

• Contract: docs/cli-contract.md#data-handling-and-security
• Complements hardening issue [Security] Enforce untrusted-input path, resource, and rendering boundaries #37
• Blocks parser/report MVP completion
• Related epics: [Epic] CLI and Project Foundation #2, [Epic] Log Parsing and Failure Extraction #4, [Epic] Evidence-Based Triage Report #18, [Epic] Testing and Fixtures #20
• Release gate: [Release] Verify and publish RunSift CLI v0.1.0 MVP #35