Security patch release. Expands best-effort redaction before persistence to cover PEM private-key blocks, common GitHub/Slack/Google credential prefixes, AWS access key IDs, credential-bearing URIs, and unquoted assignment values containing spaces. Adds persisted check-log regression coverage. Redaction remains best effort; review artifacts before sharing. Built manually from commit 9e0e976 with GitHub Actions disabled. The release contains six static CGO-disabled archives, checksums, SPDX SBOMs, and Homebrew/Scoop manifests. This manual build has no GitHub OIDC provenance.