35ab3ece48
Moved the obfuscator assembly (secrets.yml + env entries + built-in credential patterns, placeholder-key minting rules, redaction-only fallback) from createAgentSessionScoped into the secrets module so other entrypoints can build the same obfuscator.