fix(desktop): route Rive diagnostics through core redaction

[seekskyworld]

Fixes #4925

Summary

• route Rive diagnostic text through the shared core secret redactor
• apply the shared sensitive-key heuristic to structured Rive values
• cover GitHub, Google, Slack token forms and nested credential keys

Motivation

Rive diagnostics used a narrower private redaction implementation, so newly supported credential forms could remain in error envelopes or output tails. Sharing the core implementation keeps diagnostic boundaries aligned as coverage evolves.

Validation

• npm --workspace @maka/core run build
• npm --workspace @maka/desktop run build:main
• node --test apps/desktop/dist/main/tests/rive-workflow-tool.test.js (9/9)
• npx biome check apps/desktop/src/main/rive-cli.ts apps/desktop/src/main/tests/rive-workflow-tool.test.ts

[Astro-Han]

Reviewed exact head 329cde2307bd02f066e357891007374609ec3197.

I found one blocking security regression. apps/desktop/src/main/rive-cli.ts:180-182 now delegates all text redaction to @maka/core/redaction, but the previous Rive boundary explicitly masked standalone Bearer <token> values. The core pattern at packages/core/src/redaction.ts:47-48 only masks bearer values when preceded by an authorization or proxy-authorization header key, and the provider-token patterns at :58-64 do not match an arbitrary bearer value. Consequently a reachable Rive diagnostic such as Bearer opaque-session-token can remain in the emitted output/tails handled at rive-cli.ts:264-302 and in the error projection.

The new regression test at apps/desktop/src/main/__tests__/rive-workflow-tool.test.ts:249-261 covers GitHub, Google, Slack, and sensitive-key forms but does not preserve the former standalone Bearer case. Please add that coverage to the shared core redactor and a Rive regression test before considering this change complete.

The exact-head hosted label and test checks passed. I could not run the local desktop typecheck because this checkout has no usable tsc, and I did not run a separate Electron smoke test.

Automated review notice: This is an AI-assisted review and does not replace independent human review.

[seekskyworld]

Addressed the review finding in 007581eed.

• Restored standalone Bearer <token> masking in the shared core redactor.
• Added core coverage for an unkeyed bearer value.
• Extended the Rive redaction regression to cover bearer output.

Validation: core build, core redaction tests (27/27), Desktop main build, Rive tests (9/9), Biome, ASF headers, and git diff --check pass.

[Astro-Han]

Reviewed exact head 007581eed6c9d214f50b09ff96e2c0e2bbe2c64f.

The previous standalone Bearer redaction regression is fixed. packages/core/src/redaction.ts:49,82 now restores the standalone Bearer <token> pattern, and packages/core/src/__tests__/redaction.test.ts:58-63 asserts both the exact replacement and absence of the token. The Rive boundary test at apps/desktop/src/main/__tests__/rive-workflow-tool.test.ts:248-256 exercises redactRiveText() with the same form. Rive stdout/stderr chunks and tails use this path at apps/desktop/src/main/rive-cli.ts:270-297, while structured error envelopes use redactRiveValue() at :323,332.

I found no new P0-P3 correctness or security issue in the four-file increment. The exact-head hosted test check passed, and the merge-tree and diff check are clean. The local core typecheck could not start because this checkout has no usable tsc; no provider-native Rive or Electron smoke was run.

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.