* fix: safely render failure diagnostics with progressive disclosure

Omit raw engine logs and arbitrary log tails from failure reports. Render incomplete signals and extracted engine errors in bounded, redacted code blocks inside collapsed details sections.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: harden diagnostic redaction and normalization

Mask exact secrets before pattern redaction, stabilize bounded diagnostics before choosing code fences, and retain recognized engine error summaries without raw log payloads. Add final-comment regressions for nested and control-separated encoded delimiters.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>