fix: redact structured client env diagnostics

[andrei-hasna]

Remediation cycle 1 follow-up for #209. PR #209 was squash-merged at reviewed head 1228b89 while remediation was in progress, so this branch was rebased onto its merge commit and now contains only the reviewer-named P1 fixes.

• redact complete inline JSON objects/arrays before rendering an invalid loaded mode value
• redact complete inline JSON objects/arrays before rendering the local-mode client-env warning
• cover human and JSON stderr/stdout with synthetic sentinels and positive redaction assertions

Validation:

• bun test src/cli/output-safety.test.ts — 7 pass, 0 fail
• bun test src/lib/redaction.test.ts src/lib/mode.test.ts src/db/self-hosted-store.test.ts src/lib/client-env.test.ts — 65 pass, 0 fail
• bun test src/mode-axis-ratchet.test.ts — 5 pass, 0 fail
• bun test src/cli/cli-contract.test.ts src/lib/inbox-sync-status-format.test.ts — 17 pass, 0 fail
• bun run build — exit 0
• bun run secrets:staged — exit 0
• gitleaks — no leaks found

Please apply the same fixed reviewer and perform focused re-review only on the named defects and direct regressions.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}