fix: stop returning redaction mapping in model-visible tool output

[sidmohan0]

Summary

Stacked on #6 (touches the same tool registrations).

fogclaw_redact returned the full placeholder→original mapping in its content JSON, and fogclaw_preview did the same. That output persists in the session transcript, so the redaction could be trivially reversed by anything reading the transcript — partially defeating the tool's purpose.

• fogclaw_redact now feeds the mapping into RedactionMapStore and returns redacted_text, entities_found, and the placeholders list only, with the tool description and output pointing agents at fogclaw_request_access for user-approved reveals.
• fogclaw_preview drops the mapping field (dry-run stays side-effect free — it does not feed the store).
• ARCHITECTURE.md and CHANGELOG updated.

Left as-is, noted in CHANGELOG follow-ups: fogclaw_scan/fogclaw_preview still return entity spans with matched text — unlike the mapping, that reveals nothing the caller didn't already supply.

Test plan

• New red-first tests: redact output contains no mapping and no original value; preview output contains no mapping; full round-trip (redact → request_access → resolve approve) reveals the original through the backlog
• 233 tests pass, tsc --noEmit clean

[sidmohan0]

Heads up: this merged into feat/openclaw-2026.6-compat about a minute after #6 had already merged that branch into main, so this fix never reached main. Re-landed as #8 (clean cherry-pick of the same commit onto main).