fix(secrets): preserve shell snapshot syntax during redaction

[andrei-hasna]

Why

Shell snapshot redaction could consume the trailing backslash from an escaped quote when a colon-delimited value contained a secret-like segment. The redacted file then became invalid Bash, so fresh codewith exec sessions discarded their shell snapshot after validation failed.

What changed

• Capture the value spans handled by the generic and AWS assignment redactors.
• Fully replace each matched value while preserving only its trailing backslash run, which keeps the following quote escape parity intact.
• Add synthetic coverage for one- and two-backslash endings plus a full Bash snapshot export that is redacted and sourced.

Test plan

• Expected-red Blacksmith run on test-only SHA 62066c71d: https://github.com/hasna/codewith/actions/runs/30709214729
• Exact-head Blacksmith run on implementation SHA 001883e63: https://github.com/hasna/codewith/actions/runs/30709541543

Tracks OPE127-00016.