Make command diagnostics secret-safe by construction

[codeforester]

Closes #217

Summary

• add explicit --sensitive and caller-vetted --safe-display controls to std_run, gh_run, gh_report_command_failure, and gh_api_with_retry
• fail closed without rendering protected argv across dry-run, retry, timeout, fatal, authentication, API-capture, terminal, and persistent-log diagnostics
• preserve exact statuses, timing and attempt context, ordinary %q diagnostics, and successful GitHub API stdout
• require printable-ASCII safe labels and explicit separators, with value-free parser failures for malformed controls
• harden protected policy against Bash dynamic-scope mutation by in-process shell functions
• document the precise guarantee boundary for executed-command output, tracing, process listings, and caller-owned labels

Validation

• ./tests/validate.sh (398 BATS tests, smokes, examples, and all 8 option modes)
• ./tests/lint-warnings.sh
• focused std and GitHub suites (221 tests)
• adversarial security subset and manual strict/status matrix
• exhaustive safe-label byte and locale checks, including readonly LC_ALL
• git diff --check

Exact Bash 4.2.53 execution is intentionally delegated to the digest-pinned compatibility job for this PR.