Enforce sensitive Package Variable policy

[zack-nova]

Summary

• Enforces sensitive Package Variable declaration policy across manifest loading, install snapshots, declaration merging, and runtime resolution.
• Reuses a shared redaction helper for resolved sensitive values and adds doctor coverage for sensitive inline binding diagnostics.

Linked Issue

Closes #139

Dev Brief Mapping

• Acceptance criterion 1: Package Variable declarations support sensitive and reject sensitive: true declarations that also define default.
• Acceptance criterion 2: Sensitive Package Variables reject Runtime Bindings that use inline value or value_from.file.
• Acceptance criterion 3: Sensitive Package Variables accept value_from.env when the referenced environment variable is present.
• Acceptance criterion 4: hyard vars doctor reports sensitive policy violations as errors.
• Acceptance criterion 5: hyard vars explain redacts sensitive values in text and JSON output while still reporting selected source and resolved status.
• Acceptance criterion 6: Install-time and variable diagnostics do not print resolved sensitive values by default.

What Changed

• Added shared declaration validation that rejects sensitive defaults in author manifests, install records, merge compatibility, and runtime resolution.
• Added shared runtime binding value redaction and routed vars explain through it.
• Added focused tests for declaration rejection and a hyard vars doctor no-leak diagnostic case.

Validation

• Command: mise run fix
• Result: passed
• Manual verification: repository formatting/lint fix workflow completed successfully.
• Command: mise run ci
• Result: passed
• Manual verification: full repository CI workflow passed, including lint, Go tests, govulncheck, shell validation tests, and release surface checks.
• Command: sh ./scripts/test_release_surface_hyard.sh
• Result: passed
• Manual verification: public hyard release-surface smoke checks passed.

Risk

• Low to moderate: the new declaration validator is shared across multiple load and merge paths, so invalid historical sensitive defaults now fail earlier.

Out of Scope

• No changes to Runtime Binding schema shape or precedence beyond enforcing the sensitive policy contract.

Reviewer Notes

• Work was implemented in src-git/ inside the Symphony issue workspace because the root issue workspace Git metadata was locked against fetch/ref/index writes. The branch is pushed from the nested clone against current main.