feat: add credential leak detection

[sheeki03]

Summary

• add credential leak detection for known provider patterns, private keys, and high-entropy generic secrets in exec and paste contexts
• drive runtime detection, tier-1 triggers, and redaction from a shared credential_patterns.toml source of truth
• integrate SensitiveEnvExport dedup, MITRE mapping, redaction coverage, and golden fixture / unit test coverage
• replace raw provider-like fixture literals with safe test inputs so the branch can pass GitHub push protection

Testing

• cargo test -p tirith-core test_credential_fixtures -- --nocapture
• cargo test -p tirith-core redact -- --nocapture