Fix ordinary prose redaction

[chubes4]

Summary

• require explicit : or = delimiters before treating sensitive-looking prose terms as key/value assignments
• preserve explicit bearer-token redaction while leaving ordinary words such as auth fixture, token validation, and stack-frame at text intact
• add table-driven regressions pairing harmless prose with real credentials in equivalent assignment, header, bearer, cookie, and JSON contexts

Fixes #2137

Threat model

The previous heuristic accepted whitespace alone as proof that any word containing auth, token, cookie, session, and related fragments introduced a secret. That over-redacted ordinary diagnostics and stack text without adding reliable secrecy: whitespace in prose does not establish a key/value boundary.

This change narrows only that ambiguous fallback. Structured sensitive keys still redact through redactJsonValue; header lines still redact by sensitive header name; query and URL policies remain unchanged; known provider-token shapes remain redacted; explicit sensitive assignments still require redaction; standalone Bearer <credential> remains protected; and artifact redaction still replaces configured secret names and values literally. Output truncation and deterministic ordering are unchanged.

Gates

• npm run test:redaction passes
• npx tsx scripts/playground-command-errors-smoke.ts passes every command-error/redaction assertion, then reaches the independent fixture-shape failure tracked in Playground command error smoke passes an incomplete runtime spec to bootstrapPhpCode #2358
• npm run test:artifact-redaction-integrity passes
• npx tsx scripts/artifact-redaction-smoke.ts passes
• npm run test:browser-routed-command-security passes
• npm run test:production-boundary-enforcement passes
• npm run build passes
• npm run check passes 70 commands through the repaired playground-command-errors-smoke assertions, then stops at Playground command error smoke passes an incomplete runtime spec to bootstrapPhpCode #2358 (bootstrapPhpCode smoke fixture lacks the current runtime-spec shape)
• git diff --check passes
• worktree is clean after commit