fix: redact exec streams before truncation

[andrei-hasna]

Summary

Follow-up to merged PR #85. The prior fix used a fixed raw-output lookahead before redaction. That is unsafe when an earlier credential is redacted to a shorter marker: the contraction can move a later credential prefix from beyond the raw collection cap into visible bounded output.

This change:

• redacts stdout and stderr incrementally before applying the output bound;
• keeps streaming redaction state bounded;
• preserves the existing credential-pattern behavior across process chunks;
• fails closed when a custom runner reports already-truncated, non-redacted output.

Regression evidence

On the merged PR #85 state (cd6f02a4421b6d7998efeff050ed75a4347ef920), the new regression tests failed:

12 pass
2 fail

The failures covered both:

• redaction contraction exposing a later partial fixed-prefix credential; and
• a credential prefix split across separate process-output chunks.

Verification

Focused exact-candidate suite:

24 pass
0 fail
81 expect() calls
Ran 24 tests across 3 files. [6.20s]

TypeScript:

$ tsc --noEmit

Staged Shield:

No security issues found in staged changes.

Gitleaks:

8:06PM INF 0 commits scanned.
8:06PM INF scanned ~11146 bytes (11.15 KB) in 280ms
8:06PM INF no leaks found

One full production-equivalent release verification passed before the final test-only additions:

569 pass
0 fail
3022 expect() calls
Ran 569 tests across 63 files. [140.41s]

Three exact-final-candidate bun run verify:release retries each hit a different unchanged 5-second test timeout while station01 load was above its 20-core count:

• MCP HTTP transport > serves multiple concurrent HTTP clients from one process
• cli command handling > manifest read subcommands accept -j/--json like the rest of the CLI
• serve > renders dashboard html

The first two affected files passed immediately in isolation:

test/mcp-http.test.ts: 12 pass, 0 fail
test/cli.test.ts: 21 pass, 0 fail

The timeout issue is tracked separately as Todos task 5c7bd9ac-ae55-4b30-b4cc-cbd110eb4053.

Exact-head GitHub CI completed successfully on this commit:

CI run 31326063219
test: completed success
head: c2714c14e48343d7d8d9a7f023829c34030b2119

That workflow runs install, typecheck, and the complete Bun test suite. It does not run the build and consumer-conformance stages in verify:release; those stages passed in the production-equivalent full run above, before the final test-only additions.

Tracking

• Remediation task: 48f9610a-0298-4d75-8b72-1718a508a5a8
• Commit: c2714c14e48343d7d8d9a7f023829c34030b2119
• Parent: cd6f02a4421b6d7998efeff050ed75a4347ef920
• Tree: b0e6bf7a6c18ec7bff9693369e854e9264ed39dc

This PR is not authorized for merge, publish, install, or station02 changes in this lane.