sec (7/9): redact declared scanner env values from error text

[jesse-merhi]

What changes

When a user-defined scanner fails, the values of its declared env: vars are
scrubbed from the error text before the message is stored in the run artifact.
The declared value is replaced with [redacted].

Why it matters

A scanner's env: entries exist to hand it secrets. If the scanner fails and
prints one of those secrets to stderr, that stderr is folded into the artifact's
error field — persisting the secret. The existing secret-name heuristic can
miss an oddly named var, so this redacts by the actual declared value: any
env var the scanner declared has its value stripped from error text regardless
of how it is named.

Before / after (runnable)

Scanner that leaks its declared secret to stderr, then fails:

command: "echo {{target}} >/dev/null; echo leaking-value=$SECRET_TOKEN 1>&2; exit 1"
env: [SECRET_TOKEN]

	Behavior
Before	error contains leaking-value=supersekret
After	error contains leaking-value=[redacted]; raw value absent

$ SECRET_TOKEN=supersekret clawscan ./skill --config leak.yml --profile demo --sandbox off --json
# scanners.foo.error:
exit status 1: leaking-value=[redacted]

(env: {SECRET_TOKEN: "present"} in the artifact confirms presence-only
recording is unchanged.)

Verify

go test ./internal/runner/ -run 'DeclaredEnv|RedactDeclaredEnvValues' -count=1

Covers name sanitization, value redaction, and the end-to-end
"secret leaked to stderr → [redacted] in the scanner error" path.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (7/9): redact declared scanner env values from error text This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.