fix(redact): restore exact scanner placeholders and flat key matching

Merge review found two leaks against main:

• Scanner findings went through the key/value placeholder rules, so a betterleaks capture ending in prose dots was dropped. Scanner findings are exact-match again; the ellipsis rule now needs a bare prefix (sk-ant-...), not a value (hunter2...).
• Camel-split JSON keys missed shapes main matched (hostName, MySQLPassword). Match the flat normalization as well.

Also treat code literals (None, null, false) and other tools' masks (hidden, (value hidden)) as key/value placeholders, which the review trust inventory relies on, and bump the redaction fingerprint version for the new layer.