feat(secrets): redact server credentials from everything a mission records, and from the judge

The live canary run (01a0cf3d) proved the push refusal — push refused, patch
redacted, delivery.secret_blocked, no branch on the forge — and found the next
leak: the judge QUOTED the canary verbatim in its verdict, which is stored,
shown in the UI and written into the repo's project memory for later missions.

- mission_events::record (the one insert path) scrubs every event's detail and
  target: tool output such as a printenv, prompts, verdict events
- the verdict's reason, guidance, check outputs and plan are scrubbed before
  being stored or remembered
- the evidence sent to the judge, and each check's output before the judge
  model reads it, are scrubbed — the judge is another company's model

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/cm-api/src/phase_runner.rs

@@ -2733,7 +2733,25 @@ async fn evaluate_finished_phases(
             .await
             .unwrap_or_else(|e| format!("(evidence collection failed: {e})"));
 
-        let verdict = crate::evaluator::evaluate(runtime, mission_id, &condition, &evidence).await;
+        // The evidence goes to an external judge; never with a credential in it.
+        let evidence = crate::delivery_secrets::scrub(&evidence).into_owned();
+        let mut verdict =
+            crate::evaluator::evaluate(runtime, mission_id, &condition, &evidence).await;
+        // The judge reads the work and QUOTES it: a live canary run recorded the
+        // canary verbatim in the verdict's reason. Redact before the verdict is
+        // stored, turned into events, or written into the repo's project memory
+        // (which later missions receive).
+        {
+            use crate::delivery_secrets::scrub;
+            verdict.reason = scrub(&verdict.reason).into_owned();
+            verdict.guidance = scrub(&verdict.guidance).into_owned();
+            for c in verdict.checks.iter_mut() {
+                c.evidence = scrub(&c.evidence).into_owned();
+            }
+            if let Some(x) = verdict.expectation.as_mut() {
+                *x = scrub(x).into_owned();
+            }
+        }
         if let Err(e) =
             crate::evaluator::record(pool, mission_id, phase_id, iteration, &verdict).await
         {