feat(redact): path p redact credential redaction

[ulmentflam]

Adds path p redact, a plumbing command that removes credentials from an
already-derived toolpath document in place, via a reviewable plan-then-apply
flow. New tier-2 crate toolpath-redact holds the engine; path-cli gets a
thin cmd_redact.rs.

Spec: docs/superpowers/specs/2026-07-30-path-redact-command-design.md
Plan: docs/superpowers/plans/2026-07-30-path-redact-command.md

What it does

path p redact --input <cache-id|file> --dry-run          # every surface, findings or not; exit 1 if any
path p redact --input <ref> --dry-run --json > plan.json # reviewable plan
path p redact --input <ref> --plan plan.json             # apply exactly what the plan describes
path p redact --input claude-abc123                      # rewrite the cache entry in place

Detection sits behind a Detector trait, because that is where precision is
worst and the field moves fastest; traversal is stable and shared. The
built-in detector compiles a vendored gitleaks ruleset (224 rules, commit
b58d3f10, MIT). Five transforms, marker the default, which emits a typed
[REDACTED:<rule>:<keyed-fingerprint>].

p cache sync replays a stored RedactionPolicy after a re-derive, so
resuming a redacted session and syncing leaves it redacted with new turns
redacted too. That is the hazard the design was built around:
is_unchanged decides re-derivation from mtime and size and never reads the
document.

Verification

Against a real 46-step Claude session carrying seven credential types:

dry-run exit: 1        21 finding(s) redacted
Valid: Graph (id: path-claude-code-88ad1795, 1 path)
anthropic 0 · aws-id 0 · github 0 · stripe 0 · slack 0 · gitlab 0 · db-uri 0
markers: 21            idempotent: PASS        mode: -rw-------

toolpath-redact 201 tests, path-cli 383 lib + 67 integration. Nothing
#[ignore]d. clippy -D warnings and fmt clean on both crates.

What review caught that tests did not

Every item below was reproduced before being fixed, and none of the 140
tests green at the time would have failed on any of them.

• The threshold ran after overlap resolution. Resolution is score-blind
  on length, so a 0.6 container spanning a 0.99 match evicted it and the
  threshold then discarded the survivor. Both lost, and the plan reported
  only the low-confidence one. detect.rs's own doc comment forbade this in
  capitals; the code below it did it anyway.
• verify never compared content, so a plan generated against one
  document was accepted against a mutated one and markers landed at stale
  offsets. Findings now carry a keyed fingerprint that verify recomputes.
• The audit record republished the credential. Pointers beneath a
  redacted artifact key were recorded from the pre-redaction key, so the
  pass removed the secret from change and wrote it back under
  meta.redaction.
• Overlapping spans left half a credential in place while the report
  claimed both were replaced.
• Two of three credentials in a real session went undetected. gitleaks'
  anthropic rule is pinned to a live key's exact length, and
  generic-api-key stopwords ant-, so every sk-ant- key was excluded
  from the one rule that would have caught it.
• Three rules were excluded as "dialect incompatible" when they only
  needed a larger compiled-size limit. One was generic-api-key, gitleaks'
  catch-all.
• A zero-finding run still rewrote the cache file, and the flattened
  HashMaps reseed per process, so a second pass was semantically identical
  but byte-different. The integration fixtures' single-key maps, chosen to
  dodge that flake, made them structurally unable to catch it.

Deliberately not closed

Recorded in docs/superpowers/notes/2026-07-30-redaction-known-gaps.md
rather than fixed, because closing them changes behaviour beyond this
feature's scope. Worth reading before relying on this:

• p import --force, share, p cache rm, and a redact racing a sync each
  write cleartext over a redacted cache entry.
• The field map is a closed list. ~3100 of 6800 string leaves in a real
  753-step session are never scanned, including environment.vcs_branch and
  step.meta.intent (the git commit message). No credential in the verified
  document sits in one, but this is the most likely next gap.
• hash is not idempotent: bare 6-hex has no envelope, so each pass
  re-redacts the last one's output.
• share uploads the un-redacted derivation.

Notes for review

• Detector test fixtures are split across concat! so the source text does
  not match the pattern each value tests. They are synthetic, but GitHub
  push protection scans the file, not the compiled string.
• cargo clippy --workspace -- -D warnings and cargo fmt --check remain
  red on findings that predate this branch (cmd_list.rs, cmd_import.rs,
  toolpath-pi/src/reader.rs, rustfmt drift in toolpath-codex). Left
  untouched deliberately.
• docs/superpowers/notes/2026-07-30-redact-execution-state.md is a
  working checkpoint and should be deleted on merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_012EurfyRkeTRc74v1mDum61

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}