[FEATURE] GAP-130: detect-secrets redaction before report display/upload

[hello-args]

Summary

Redact secret values in findings before terminal display, HTML, SARIF, or upload — distinct from home-path redaction (#87).

Problem

GAP-130 in the feature expansion plan is missing. Finding evidence may contain sensitive snippets.

Expected Behavior

Integrate detect-secrets or equivalent redaction layer before user-visible report output.

References

• GAP-130 — feature expansion plan
• [SECURITY] mcts inventory reads local MCP configs without consent gate #87 — home path redaction only

Acceptance Criteria

• Redaction hook in reporting pipeline
• Tests with synthetic secret fixtures
• Documented limitations