[gersham]

Fixes ENG-5821 (secrets leak).

The leak

The doctor token row set detail: describeToken(resolved.token), and
describeToken returned redactToken(token), which was
`sr_live_${lookupId}_***`. That is not a redaction: the lookup segment
identifies the live credential, so screenrig --json doctor, the human
doctor lines, account show, and every redactText / redactValue path
printed a usable prefix of a production token. account show also carried it
as an envelope field named token_lookup.

The fix

• src/redact.ts: redactToken is gone. A redacted credential is the constant
  REDACTED_TOKEN (sr_live_***) with no lookup id, used by redactText and
  by the sensitive-key path in redactValue. tokenLookupId stays, documented
  as internal correlation that never reaches output; nothing on an output path
  calls it any more except the check that decides sr_live_*** versus ***.
• src/config.ts: describeToken is replaced by hasToken (boolean) and
  describeTokenPresence (present / (none)). Neither reads the value.
• src/commands.ts: the doctor token row reports
  describeTokenPresence(resolved.token) and keys its pass / fail off
  hasToken. account show reports token_present: boolean in the envelope
  (renamed from token_lookup, which cannot be populated without leaking) and
  token: present in the human line.
• README.md documents that the token row is presence only. AGENTS.md
  records the rule so the shape is not reintroduced.

Tests

• New in src/cli.test.ts: with a realistic
  sr_live_<id>_<secret> fixture in config, the token check still passes,
  its detail is exactly present, the JSON envelope includes the check, and
  neither --json doctor stdout nor human doctor stdout matches /sr_live_/,
  the lookup id, or the secret segment. A second test asserts the unconfigured
  host fails the row with (none) and still prints no token shape.
• account show assertions extended: token_present is true, the human line
  is token: present, and stdout matches neither /sr_live_/ nor the fixture
  lookup id.
• src/redact.test.ts: the previous expectation of sr_live_identifier_*** is
  updated to sr_live_***, plus a regression test that no redaction path keeps
  the lookup segment.

Verification

npm ci, npm run check:public, npm run vendor:check, npm run typecheck,
npm run lint, npm test (349 tests, 348 pass, 1 pre-existing skip that needs
SCREENRIG_EXTRACTOR_BIN), and npm run smoke:mock all pass. No vendored file,
workflow, or deploy configuration is touched, and no real credential was used.

Scope

Doctor/redaction presence only. Independent of the primitive+selector rename
work; nothing here belongs on that PR. Do not merge until Sec signs ENG-5821.