privacy: YAML and BOM-prefixed JSON/TOML keep values under credential-flagged keys #4519

Observed

Found by the adversarial review of PR #4515, on both pre-#4490 master (36eedb3ee7^1) and the PR head:

• A YAML document whose object key is flagged as a credential is not quarantined. The YAML path does not inspect keys structurally; the raw scan replaces the key with [TraceDecay redacted: high-entropy token], and the value under that key is left as is.
• The same happens for JSON and TOML files that start with a UTF-8 BOM: they do not parse as JSON/TOML (format is None), so they fall back to the raw scan with the same result.

Why it matters

For JSON/TOML the contract is: a flagged key is redacted and every value under it is redacted (or the file is withheld). For YAML and BOM-prefixed JSON/TOML, a value under a credential-shaped key survives unless it is secret-shaped on its own, e.g. api_keys:\n <secret>: admin-user-42 keeps admin-user-42, and a low-entropy secret stored under such a key is indexed.

Expected

YAML (and BOM-prefixed JSON/TOML, after stripping the BOM for parsing) follow the same contract as JSON/TOML: redact the flagged key and every value under it, or withhold the file when that cannot be done safely.