fix: scrub public and persisted workflow output

[andrei-hasna]

Replacement for the bounded confidentiality gaps identified on stale PR #66.

Summary:

• re-scrub public show-output and human text stdout/stderr/error surfaces, and describe MCP output as scrubbed
• route SQLite and Postgres workflow recover/skip/finalize/cancel/skipped-run reasons and errors through shared scrub helpers with parity
• deep-scrub Postgres goal evidence and raw responses before JSON stringify, matching SQLite
• add focused public-format, SQLite, Postgres, and MCP schema regressions

Validation:

• focused: 87 pass, 29 environment-gated Postgres skips, 0 fail
• full suite: 931 pass, 29 environment-gated Postgres skips, 0 fail
• bun run typecheck
• bun run build
• staged and committed credential-pattern scans passed

Explicitly excluded: historical output quarantine and cross-package follow-ups.