journal: token shapes are redacted from tool output before anything keeps or shows them #81

A worker ran gh auth token and the OAuth token sits in plain text in two task journals (#76 §1). Redact known secret shapes (gho_/ghp_/github_pat_/sk-…/AKIA…/Bearer …/PEM blocks) in tool results before journaling, display, and the model; generic pattern table, not a list of services; manual line under what aforge never keeps.

Part of #76. Branch ground/redact → PR into feat/task-ground.

Drafted with CodeAF · reviewed and owned by the author