Release v7.68.1

Fixed

• Provider error bodies no longer leak secrets: the calling provider's configured key is withheld by exact value (also when echoed URL-encoded) before any pattern runs, long tokens containing / are withheld, and only the failed request's exact model and provider ids stay readable, so a short model id inside a longer secret no longer lets that secret through. (#575)
• A pooled chat call now treats HTTP 402 or a vendor insufficient_quota code as a spent quota and fails over to the next provider, instead of failing permanently. (part of #569)
• Agent-harness workers report a spent Claude Code allowance only for the known subscription-limit phrases, and a Copilot worker reads a spent quota only from its error or result events, not from the agent's own text. (part of #569)
• When the pull-request body guard cannot read a --body-file, it now says which path it tried, whether the file and its folder exist, the working directories and which checker script ran, instead of a bare ENOENT. (part of #517)