Propagate publish failures and redact fetch errors

[walker1211]

Summary

• Return publish-hook failures to the caller and update seen state only after post-Markdown actions succeed.
• Redact credentials from failed-source console output, source stats, and email content.
• Restrict history secret scanning to publishable refs so tool-internal refs do not cause false positives.
• Ensure the scheduler heartbeat test stops its background watcher before temporary state cleanup.

Test plan

• scripts/ci-local.sh clean
• go test ./cmds/news-briefing -run TestScheduledBriefingCronWaitsWhileXHeartbeatFresh -count=50