Harden sensitive-option redaction and runtime cleanup boundaries

[codeforester]

Parent: #50

Train position: 4 of 22
Phase: P0 — Trustworthy lifecycle

Problem

Sensitive option aliases can leak secrets, while profile-supplied cleanup paths can trigger recursive deletion without proving ownership or containment.

Acceptance criteria

• Every declaration and alias of a sensitive option is recognized, including short options, alternate long options, and destination names.
• Spaced, attached, and equals-form sensitive values are redacted in invocation and history records without consuming unrelated flag arguments.
• Sensitive arguments and documented automatic secret-name heuristics are supported.
• Recursive cleanup proves the target is inside the invocation-owned runtime root using symlink-safe containment and refuses broad or out-of-bound targets.
• Property and regression tests cover aliases, malformed argv, traversal, symlinks, and root-like paths.

Dependencies

• Make lifecycle teardown failure-safe #51