Function redact_string 

pub fn redact_string(s: &str) -> String

Redact a single free-form string (used for vs_inspect eval expressions in args_redacted). Replaces inline bearer ... / token = ... style secrets with ***. Matching is intentionally loose so casually-pasted credentials don’t survive the audit log.