Update public CLI log redaction

scripts/cli-first-contract-smoke.js

@@ -97,6 +97,11 @@ expect(
   "mutating commands require confirmation",
   /Mutating or dangerous commands support `--yes`[\s\S]*confirmation-required safe failure[\s\S]*do not send coordinator requests/
 );
+expect(
+  criteria,
+  "log redaction criteria",
+  /Logs are capped, truncated honestly[\s\S]*preserve byte counts and truncation flags[\s\S]*Secret-like values are redacted[\s\S]*common token\/password\/bearer patterns/
+);
 expect(
   cliFirstAcceptance,
   "CLI-first acceptance report",
@@ -219,6 +224,7 @@ for (const [name, pattern] of [
   ["quota coordinator usage coverage", /fn quota_status_queries_public_coordinator_usage\(\)/],
   ["task event summary coverage", /fn process_task_log_and_artifact_reports_summarize_task_events\(\)/],
   ["task locality failure summary coverage", /fn process_task_log_and_artifact_reports_summarize_task_events\(\)[\s\S]*source snapshot unavailable and direct connectivity unavailable[\s\S]*locality_failure/],
+  ["log secret redaction coverage", /fn log_and_task_reports_redact_secret_like_values\(\)/],
   ["artifact download/export report coverage", /fn artifact_download_and_export_reports_expose_safe_session_boundaries\(\)/],
   ["process control report coverage", /fn process_restart_and_cancel_reports_expose_control_boundaries\(\)/],
   ["task restart report coverage", /fn task_restart_reports_clean_boundary_requirements\(\)/],
@@ -348,6 +354,11 @@ expect(
   "CLI renders task placement reasons",
   /fn push_task_placement_reasons[\s\S]*placement \{task_name\}: \{node\}/
 );
+expect(
+  cli,
+  "CLI redacts secret-like log values",
+  /fn log_entries[\s\S]*redact_secret_like_text[\s\S]*secret_like_values_redacted[\s\S]*redacted_fields[\s\S]*fn redact_secret_like_text[\s\S]*access_token=[\s\S]*password=[\s\S]*bearer /
+);
 expect(
   cli,
   "CLI classifies machine-readable error categories",