fix(redaction): scrub suffixed secret assignments

[drewstone]

Problem

The assigned-secret rule relied on a word boundary before names such as API_KEY or TOKEN. Underscores are word characters, so prefixed environment names such as VENDOR_API_KEY retained their values.

Change

• Match the complete shell/environment assignment identifier and require it to end in a recognized secret suffix.
• Redact bare, quoted, ANSI-C quoted, concatenated, escaped, expanded, short, and punctuation-bearing synthetic values.
• Preserve identifiers whose secret-like word appears before a non-secret suffix and preserve commands after an environment assignment.

Proof

• Reproduction before the fix: focused suite failed with all synthetic prefixed values retained.
• pnpm vitest run tests/upload.test.ts: 17/17 passed.
• pnpm test: 397/397 passed.
• pnpm typecheck: passed.
• pnpm build: passed.
• pnpm check:package: passed.
• Synthetic stress: 10,000/10,000 secret-suffix assignments redacted; 10,000/10,000 benign controls unchanged.
• A 1,000,021-byte adversarial non-match completed in 6.623 ms.
• Independent adversarial review found partial leaks in ANSI-C and concatenated shell values; commit 0de22e4 fixes both and adds fragment-level assertions.

Only synthetic values were used. No raw live traces or credentials were opened.