Credential masking: route remaining free-text telemetry through the fixed-vocabulary error detail #1676

Each denylist masking round has found a new leak shape. The chosen direction (#1544) is the fixed vocabulary in altimate/telemetry/error-detail.ts, where every word outside the vocabulary becomes <x>. Remaining Telemetry.maskString callers (for example mcp/index.ts, native/connections/register.ts, registry.ts, reconnect-log.ts, project-scan.ts) should move to it. Compaction ledger redaction is a separate path with the same CLI-idiom gaps.

Items

• security: extend credential redaction to mysql -p<password> and PG* env-var idioms #1287: Compaction redaction misses mysql -p<password> and PGPASSWORD-style environment idioms.
• security: Telemetry.maskString leaves bare password=value and PWD=value unmasked #1457: Telemetry.maskString leaves bare password=value / PWD=value unmasked.
• fix(telemetry): mask the words after a credential word in error_message #1588: Vocabulary words that follow a credential word in error_message are preserved; mask the suffix of a credential word.

The linked issues hold the original reports and reproductions. Most are closed in favor of this tracker; any child with an open fix PR stays open until that PR lands.