Function redact_secrets 

pub fn redact_secrets(text: &str) -> String

The full redaction pipeline. Order matters: the original credential-prefix and private-key passes run first (unchanged, so their existing callers’ exact output is preserved byte-for-byte on inputs that only they match), then the newer, broader shape-based passes.