fix: cover common credential forms

[andrei-hasna]

Summary

• cover bare pass assignment keys such as DB_PASS in local-content redaction
• redact case-insensitive Basic authorization credentials alongside Bearer credentials
• add direct and emitted local-content regression coverage

Context

PR #8 merged as fcbce00333c3d05b4a9da206ad979579adf45a37 before the independent NO_GO review comment was posted. The merged tree exactly matches reviewed head 000d6fb720bbea0d3db3ce669fcba081cd1aacba, so this hotfix carries the named P1 remediation forward from current main.

Verification

• pre-fix focused regression: exit 1, 44 pass, 2 fail, 99 expect() calls
• post-fix redaction/local-query lane: exit 0, 46 pass, 0 fail, 104 expect() calls
• post-fix persistence/find lane: exit 0, 28 pass, 0 fail, 87 expect() calls
• bun run typecheck: exit 0
• bun run test: exit 0, 279 pass, 0 fail, 753 expect() calls
• staged shield review: exit 0, no security issues found

Follow-up to #8.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #9 @ 398b13c — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Focused re-review scope: the single P1 named on #8 at 000d6fb, its remediation, and direct regressions only.

Named defect verification:

• bare pass assignment keys now reach the existing assignment redactor, including DB_PASS
• Basic authorization credentials now reach the shared case-insensitive authorization redactor alongside Bearer credentials
• direct control: db_pass_assignment: value_present=false changed=true
• direct control: basic_authorization: value_present=false changed=true
• safe-content control: ordinary_prose_control: unchanged=true

Commands and gates:

• pre-fix focused regression: exit 1, 44 pass, 2 fail, 99 expect() calls
• post-fix redaction/local-query lane: exit 0, 46 pass, 0 fail, 104 expect() calls
• post-fix persistence/find lane: exit 0, 28 pass, 0 fail, 87 expect() calls
• bun run typecheck: exit 0; tsc --noEmit emitted no pass/fail count
• bun run test: exit 0, 279 pass, 0 fail, 753 expect() calls across 25 files
• staged shield review: exit 0, No security issues found in staged changes.

Blocking P0/P1 findings: none remain in the focused remediation scope.

Non-blocking follow-ups: none.