perf: Use HashSet for O(1) secret masking lookups

[thomhurst]

Summary

Fixes #1539

Changed BuildSystemSecretMasker from List<string> to HashSet<string> for tracking already-masked secrets.

Changes

• Replaced List<string> with HashSet<string> for _alreadyMaskedSecrets
• Use HashSet.Add() return value to check if already exists (returns false if duplicate)
• Removed LINQ .Where() filter in favor of direct HashSet operation

Performance

Operation	Before	After
Lookup per secret	O(n)	O(1)
MaskSecrets overall	O(n*m)	O(m)

Where n = existing secrets, m = new secrets

Test plan

• Build succeeds
• Verify secret masking still works correctly

🤖 Generated with Claude Code

[thomhurst]

Summary

Performance optimization that replaces List with HashSet for O(1) secret deduplication in BuildSystemSecretMasker.

Critical Issues

None found ✅

Suggestions

None - this is a clean performance improvement with correct implementation.

Verdict

✅ APPROVE - No critical issues

Analysis:

• Changes _alreadyMaskedSecrets from List to HashSet for O(1) vs O(n) lookups
• Replaces Where(s => !_alreadyMaskedSecrets.Contains(s)) with idiomatic HashSet.Add() pattern
• Maintains thread-safety with existing lock
• Improves performance in secret masking hot path without changing behavior
• Comment clearly documents the optimization rationale

[Copilot]

Pull request overview

This PR optimizes the secret masking performance by replacing a List<string> with a HashSet<string> for tracking already-masked secrets, reducing lookup complexity from O(n) to O(1).

Key Changes:

• Changed _alreadyMaskedSecrets from List<string> to HashSet<string>
• Leveraged HashSet.Add() return value to eliminate duplicate checking logic
• Removed LINQ .Where() filter in favor of direct HashSet operations