Fix credential guard gaps and clarify private-note storage

[suboss87]

Fix

The write guard accepted hyphenated AI-provider keys and secret assignments shorter than eight characters, allowing accidental credentials into Git-backed engagement records. Extend supported key characters and reject nonempty assignments regardless of length. Output masking covers the same assignment forms, including punctuation and escaped quotes.

Private-note confirmation now explains that hidden content remains plaintext in local files and Git history. Credential refusal explains that undo/redact does not erase history and exposed credentials need rotation. The deliberate --force override remains available with a warning.

Includes version 5.1.24 and synthetic regression tests for write refusal, unchanged history, debrief/ingest, whole-value masking, and ordinary nonsecret text. No real credentials or customer records were used.

Validation

• 18 credential regressions passed; focused masking and ingestion coverage passed.
• Independent review found no remaining concrete regressions after correction.
• npm run check: 509 tests passed, zero failures or skips on the final revision.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.