[FEATURE] Path redaction for mcts scan --machine-wide output

[hello-args]

Summary

Reuse inventory path redaction for mcts scan --machine-wide terminal and JSON output.

Problem

run_machine_wide() calls run_inventory() (src/mcts/scan/machine_wide.py:145) and prints/writes full config_path values. Inventory privacy flags from #87 / PR #279 do not apply to the mcts scan --machine-wide command.

Expected Behavior

Optional --redact-paths on machine-wide scan (or shared export helper) redacts home prefixes in fleet summaries and written JSON.

Evidence

• src/mcts/scan/machine_wide.py:145 — inventory = run_inventory()
• src/mcts/inventory/discoverers.py — redact_home(), redact_entry_dict() (after PR feat(inventory): add privacy controls for config discovery (#87) #279)
• src/mcts/cli/machine_wide.py — fleet CLI output

Impact

Machine-wide audits on developer laptops may expose full home paths in CI artifacts.

References

• [SECURITY] mcts inventory reads local MCP configs without consent gate #87 / PR feat(inventory): add privacy controls for config discovery (#87) #279 — inventory-only redaction today
• [FEATURE] Wire --redact-paths through inventory --scan-all JSON export #288 — scan-all export redaction (same pattern)

Acceptance Criteria

• Redaction applied to machine-wide terminal and JSON output surfaces
• Documented in docs/platform/cli.md
• Tests or fixture assertion on redacted paths