fix: harden redaction and temp cleanup boundaries

[codeforester]

Closes #54

Summary

• compile a Click-aware redaction plan across command trees, aliases, destinations, value forms, sensitive arguments, and documented secret-name heuristics
• redact argv once before it reaches logging, history display resolvers, or custom history writers, with synchronized fail-closed plan publication
• claim invocation temp leaves through stable no-follow parent handles and retain an ownership descriptor through teardown
• validate run-root containment, inode identity, symlink boundaries, devices, and Linux mount IDs before descriptor-relative content erasure
• retain partial logs and empty directory nodes instead of reopening pathname unlink or rmdir replacement races
• document the native Windows fallback and the explicit same-account filesystem threat boundary

Validation

• 214 tests and 54 generated subtests on current Click
• 214 tests and 54 generated subtests on Click 8.1.8
• deterministic adversarial coverage for publication, creation, replacement, traversal, mount-identity, rollback, and descriptor-lifecycle races
• isolated sdist and wheel build validated with scripts/validate_package_artifact.py
• ./tests/validate.sh
• git diff --check

Security review

Two independent adversarial review passes completed. The final pass found no merge blockers after verifying the exact rollback-symlink, nested-directory replacement, missing-mount-ID descriptor leak, and concurrent redaction publication reproductions.