security: redact complete delimiter-bearing secret values

[codeforester]

Goal

Ensure fallback redaction never leaves a suffix of a recognized secret value visible merely because the value contains a comma or semicolon.

Background

The fix for #211 taught fallback redaction to find embedded sensitive assignments, but both implementations now treat , and ; as unconditional ends of the secret value. Those characters are also valid inside passwords, tokens, and authorization values. The prefix is replaced while the remainder is retained in argv/history text and JSON envelopes.

Reproduction and evidence

Framework reference: 263d893 on main.

redact_argv(["tool", "PASSWORD=abc,def"], set())
# ['tool', 'PASSWORD=[REDACTED],def']

redact_argv(["tool", "PASSWORD=abc;def"], set())
# ['tool', 'PASSWORD=[REDACTED];def']

dumps_envelope(error_envelope(
    run_id=None, code="bad", message="PASSWORD=abc,def"
))
# ... "message":"PASSWORD=[REDACTED],def" ...

The relevant boundaries are _INLINE_SEGMENT_END in redaction.py and _SENSITIVE_ASSIGNMENT in json_contracts.py.

Scope

• Define an unambiguous segment grammar that distinguishes the next assignment from punctuation inside the current sensitive value.
• Redact the complete sensitive value across argv/history, log text, and JSON envelope paths.
• Preserve redaction of query strings, comma-separated assignments, and header-style values added for Redaction fallback misses secrets embedded in query strings, comma-separated lists, and header-style values #211.
• Add delimiter-bearing and multiple-assignment adversarial tests.

Acceptance criteria

• No substring of abc,def or abc;def remains when it is the value of a recognized sensitive key.
• A subsequent non-sensitive assignment can remain visible without exposing the preceding secret.
• URL credential and Click-aware positional/option redaction continue to pass.
• The full security and JSON contract suites pass.

Project fields

• Status: Backlog
• Priority: P1
• Area: Security
• Initiative: v1.0 Readiness
• Size: M

Ownership

• Assignee: @codeforester