Add diagnostic redaction regression tests

[Buyurgutdev]

Summary

Closes #1

Adds deterministic regression coverage around diagnostic metadata redaction, repository-relative artifact paths, and JSON-to-.logd pairing validation.

Changes

• Added reusable diagnostic helpers in build.py to redact local-only values from diagnostic metadata text.
• Normalized diagnostic artifact paths to repository-relative / paths when building the report.
• Added validate_diagnostic_metadata() to fail clearly for missing JSON, missing .logd, mismatched paths, absolute paths, backslashes, or local value leaks.
• Added focused Python unittest coverage for redaction, relative path reporting, and artifact pairing failure cases.
• Included generated diagnostic metadata from python3 build.py for this branch commit.

Testing

• python -m unittest tests.test_diagnostic_redaction -v - passed on Windows.
• python -m compileall build.py tests\test_diagnostic_redaction.py - passed on Windows.
• git diff --check - passed.
• python3 -m unittest tests.test_diagnostic_redaction -v - passed under Ubuntu WSL.
• python3 build.py - executed under Windows and Ubuntu WSL; both attempts reached the diagnostic preflight but encryptly timed out after 60s before creating an encrypted .logd. The generated metadata is committed at diagnostic/build-7cf6d071.json and records the blocker.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR (blocked: encryptly timed out before producing .logd; generated JSON metadata is committed)
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging

[Peter7896]

Thanks for the PR. The test direction is aligned with the diagnostic-redaction issue, but this is not bounty-ready yet because the required encrypted diagnostic log is missing.

The PR currently commits diagnostic/build-7cf6d071.json, but no matching diagnostic/build-*.logd is present, and the checklist notes that encryptly timed out. Please rerun the current build script on the PR branch and include the exact script-generated matching .json and .logd artifacts. If the build script still cannot produce the .logd, please leave the PR open with the blocker described, but I cannot forward it for payout review until the diagnostic pair is complete.

[ghost]

Thanks for the PR. I found diagnostic JSON metadata, but I don't see the encrypted build diagnostic log artifact (*.logd / builds.compact) committed on this branch yet. Please rerun the build diagnostic/encryption step with the fixed encryptly tooling and commit the generated encrypted log artifact to this PR (typically under diagnostic/).

Blocking review until the encrypted diagnostic log artifact is present.