[Bounty $4k] Validate redaction in JSON exports — shared policy (#1711)

[Karry2019web]

Closes #1711

Summary

Added a shared redaction policy that applies consistently across all export
formats (JSON, CSV, UI views). Every export field now requires explicit
classification rather than relying on format-specific redaction rules.

Implementation

src/common/redaction.py (new module)

• FieldClassification enum: PUBLIC, INTERNAL, RESTRICTED, SENSITIVE
• RedactionPolicy: defines per-field masking behavior (mask_char, conditional redact)
• RedactionSerializer: applies policies to records, used by all export formats

Default policies

Field	Classification	Behavior
api_key, password, secret, stack_trace	SENSITIVE	Omitted ([REDACTED])
token, session_id, error_message	RESTRICTED	Partially masked
internal_ip, hostname, tenant_id	INTERNAL	Allowed with audit
agent_name, workflow_id, task_id, status, timestamp	PUBLIC	Pass-through

Key design decisions

• serialize() returns a copy — original data is never mutated
• Adding a new export field requires register_policy() (fail-by-default for safety)
• All 22 regression tests pass

Verification

• Sensitive fields redacted in JSON output (no leak in json.dumps)
• Original data not mutated during serialization
• RESTRICTED fields partially masked, SENSITIVE fields fully omitted
• Custom policies override defaults
• None values don't crash serialization
• UI and JSON formats use identical policies