Make command diagnostics secret-safe by construction

[codeforester]

Parent: #214

Train position: 3 of 26
Phase: P0 — Trustworthy runtime and release baseline

Problem

std_run and GitHub helpers can render complete command arguments during dry-run, retry, timeout, and final failure. Professional scripts need useful diagnostics without making credentials in headers, fields, URLs, or option values part of terminal or persistent logs.

Acceptance criteria

• Add explicit sensitive-command and safe-display controls shared by the command runner and GitHub helpers.
• Ensure protected commands expose no raw argument values in terminal logs, persistent logs, dry-run plans, retry notices, timeout reports, or final-failure diagnostics.
• Allow callers to provide a safe human-readable operation label while retaining status, timing, attempt, and failure context.
• Cover canary secrets in spaced values, --option=value, headers, URL userinfo, form fields, and nested helper calls.
• Preserve argument-safe diagnostics for ordinary non-sensitive commands.
• Document caller responsibilities and do not present heuristic redaction as a guarantee for arbitrary subprocess output.

Dependencies

• None