Merge origin/main into redact-2

Reconcile with main's redaction rework (ENT-3135..3138), taking main's stricter rules wherever the two disagree:

• Placeholders: the key/value check now builds on main's isPlaceholderSecretValue (complete ${...} expressions only, $UPPER and %s/{name} templates), so ${X:-hunter2}, $hunter2 and {hunter2} are secrets again. The branch adds only key/value-specific shapes on top: non-printing $(...) recipes, doc fill-ins (your_api_key_here), ellipsis prefixes, Go templates, and non-password code literals/masks. Single quotes keep literal placeholder words only.
• DB-password values use main's loop (separator extension, Azure SAS sig), now quote-aware; credential assignments extend across separators too.
• *_id keys follow main's identifier ruling: only the AWS access-key id is treated as a credential; api_key_id / api_token_id are identifiers.
• Fingerprint version 7 (main is at 6).