fix(doctor): configure redaction in bundle, not the whole doctor group

The group-wide PersistentPreRunE made logs, trace, bundle --raw and migrate-checkpoints --dry-run fail on an invalid scanner config, though none of them redact — blocking the tools for diagnosing that setup. Keep main's doctor pre-runs and have the redacted bundle configure redaction itself, as migrate's push path already does. Pin it with a test that runs through the doctor parent.