Function redact_secrets 

pub fn redact_secrets(line: &str) -> String

Redact known secret patterns from a line of command output.

This is a best-effort deterministic redaction — it covers common formats (API keys prefixed with sk-, bearer tokens, password assignments) but cannot catch every possible secret. The patterns are intentionally simple so they are predictable and auditable.

Redacted values are replaced with [REDACTED] so the user can see that a secret was present and scrubbed.