fix: redact secrets from persisted operation records

[leoxk]

Summary

• derive redaction replacers from conventionally sensitive Stack environment keys, including when secret interpolation is disabled
• sanitize all persisted Update free-form fields, including logs, other data, and previous/current TOML snapshots
• redact secret Variable values from create, update, and delete operation records
• reuse the existing Core to Periphery replacer seam so Compose Config output and deployed config are sanitized before persistence
• remove raw Stack create/update config serialization from tracing spans

Tests

Tests use only the synthetic marker komodo-redaction-marker-4d9c1d48f7b84a9e. No production values or credentials were used.

Added coverage for:

• sensitive and non-sensitive environment key classification, including the nine deployment key shapes reviewed for this fix
• empty environment values
• direct Stack environment redaction
• redaction when interpolation is disabled
• Update logs and audit TOML snapshots
• secret Variable operation records
• a source guard that prevents Stack create/update tracing spans from restoring full config serialization

Local git diff --check passes. A focused scan of the seven changed files found no credential-shaped literals; the only marker matches are the three intended synthetic tests. Rust and Docker tooling are not available in the local environment, so this Draft relies on upstream CI for formatting, compilation, and test execution. The upstream workflow currently requires maintainer approval for fork code and has run no jobs yet.

Scope and limitations

• This prevents new persisted operation records and the identified Stack tracing spans from retaining detected values; it does not clean historical records or logs.
• Existing admin Variable read semantics are unchanged.
• Direct Stack environment values have no is_secret metadata, so detection is deliberately based on high-confidence key names: password/passwd, secret, token, credential(s), DSN, API key, private key, access key, and connection string.
• Unconventionally named secret keys are not detectable without adding explicit secret metadata to Stack environment entries.
• Literal secrets in Compose file contents or external env files are outside this key/value seam.
• Empty values are ignored to avoid replacing every empty string.
• This patch is needed in addition to the current 2.3.2 code; upgrading from 2.3.1 to stock 2.3.2 alone does not address these persistence paths.

No deployment, migration, historical cleanup, or credential rotation is included.