fix(redact): keep merged placeholder rules scoped to key/value captures

Merge review found the $(...) exemption let $(/bin/echo x) and $(cat <<< x) keep literals main redacts; only allowlisted secret-fetching commands without quotes or redirection count now. The shared hasNonPlaceholderPasswordValue is back to main's rules, so connection strings redact as a unit again; the DB-password loop adds only the single-quote literal rule, uppercase <NAME> placeholders apply to key/value captures only, and JSON leaves honor non-password masks. Prefilter the shell-stdin layer on printf/secret.