fix(errors): redact supported provider API keys

[sylvesterkaczmarek]

Summary

Recognize supported Linear and Fireworks API-key prefixes in the shared credential-bearing error redactor.

Fixes #521.

Reproduction / evidence

safeErrorMessage() is the persistence/display boundary for errors. Current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba recognizes several credential prefixes, but not the supported Linear lin_api_ or Fireworks fw_ forms.

Deterministic examples on the unfixed implementation:

safeErrorMessage(new Error("Linear failed for lin_api_SYNTHETIC_SECRET"))
safeErrorMessage(new Error("Fireworks failed for fw_SYNTHETIC_SECRET"))

Both messages can pass through unchanged because neither token is presented as a Bearer value or a named assignment.

The Linear prefix is already represented by this repository's integration fixtures. Fireworks is also an explicit Codex Security inference provider (FIREWORKS_API_KEY), and Fireworks' API-key documentation shows issued keys using the fw_ prefix.

Expected result for both examples: [redacted].

Root cause

The shared redactor uses a finite known-prefix branch. Linear and Fireworks support were added without adding their bare credential prefixes to that branch, leaving callers dependent on incidental formatting or caller-specific secret comparisons.

Fix

• add lin_api_ to the known credential-prefix branch;
• add fw_ to the same branch;
• keep assignment, bearer-token, URL-credential, and private-key detection unchanged.

Tests / validation

The existing table-driven error-redaction regression now includes synthetic Linear and Fireworks credentials and requires both complete messages to become [redacted].

The original branch was created from upstream main at 99c85613b0c4b8202b33dfbd80f41884fb9eac11. I re-verified the same missing-prefix behavior on current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba before adding the Fireworks case.

Full repository tests cannot be run in this execution environment because the repository cannot be cloned here. Pushed-head CI remains the authoritative full-suite validation.

Risk

Low. Newly redacted messages are limited to strings containing supported credential prefixes. Ordinary words and existing redaction behavior are unchanged.