Harden todos pre-write secret redaction

[andrei-hasna]

Summary

• Adds a central pre-write scanner/redactor for task, comment, verification, dispatch, inbox, run, artifact, import, and export write paths.
• Redacts before persistence by default, including nested object values and secret-shaped object keys.
• Makes bridge/import-export/backups redacted by default, with the CLI bridge unsafe plaintext path only used as input to encrypted exports.
• Adds synthetic invalid secret regression coverage without committing complete credential literals.

Verification

• Staged secrets scan over git diff --cached passed before commit.
• bun test src/no-cloud-boundary.test.ts src/lib/prewrite-secrets.test.ts src/db/prewrite-secrets.test.ts src/lib/import-export-bridge.test.ts src/lib/local-bridge.test.ts src/lib/local-backups.test.ts src/lib/local-encryption.test.ts src/lib/secret-redaction.test.ts src/lib/redaction.test.ts src/db/dispatches.test.ts src/db/task-runs.test.ts src/db/task-commits.test.ts passed: 88 pass, 0 fail.
• bun run typecheck passed.
• bun run build passed.
• bun test --timeout 20000 passed after reconciliation. Default bun test was also attempted and hit known 5s CLI subprocess timeout budgets under full-suite load.

Adversarial Review

• codewith review --uncommitted reported two P2 gaps: object keys were not redacted, and stored artifact source paths could persist raw path segments.
• Reconciled both findings with central key sanitization, artifact source-path sanitization, and regression tests.

Task: 78daf2c3-f6a3-456a-88bd-2db31f999065