add secret protection for sensitive files

[hyle]

Summary

Add default-on secret protection to fuori so obviously sensitive files are excluded from exports unless the user explicitly opts in.

Changes

• Add --allow-sensitive to bypass secret protection for a run
• Skip sensitive files by default and print a generic warning to stderr
• Add filename-based screening for obvious high-risk files such as:
  • .env*
  • credentials*
  • secret*
  • id_rsa*, id_dsa*, id_ecdsa*, id_ed25519*
  • *.pem
  • *.key
• Add content-based screening for obvious secret material such as:
  • private key block headers
  • AWS-style access key IDs
  • GitHub token prefixes
  • OpenAI-style sk- keys
• Add skipped_sensitive tracking to verbose skip summaries
• Ensure sensitive files are omitted from Change Context in --staged, --unstaged, and --diff
• Update README and docs/design.md with the new behavior
• Add CLI coverage for:
  • help output
  • filename-based blocking
  • content-based blocking
  • --allow-sensitive
  • warning redaction
  • staged change-context omission

Behavior

• Secret protection applies in all selection modes, including --from-stdin
• Sensitive files are omitted entirely from the markdown output
• Warnings do not include matched secret values
• --allow-sensitive disables both filename-based and content-based protection

Verification

• Ran make test successfully