fix(redact): tighten shell-stdin, identifier and placeholder rules

Trail findings on the post-merge head:

• secrets-store writes redact the piped literal for any key except a plain identifier (STRIPE_KEY, DATABASE_URL leaked);
• session/request/nonce/csrf/cookie ids keep entropy scoring;
• doc fill-ins must name a credential (your-dog-name is a passphrase);
• ellipsis placeholders need a short letter-only vendor prefix (hunter2-... is a value). Fingerprint version 8.