pub fn replacement(kind: &SecretKind, hash8: &str) -> StringExpand description
Build the replacement token {{REDACTED:<kind>:<hash8>}}. The token is a
detection fixed point: the :/{/} separators break any charset run,
and no built-in pattern matches the slugs, so redacted output never
re-triggers a detector.