fix(desktop): route Rive diagnostics through the core secret redactor #4925

Problem

apps/desktop/src/main/rive-cli.ts maintains a private redactRiveText implementation alongside the authoritative @maka/core/redaction rules. The local copy only recognizes a small set of bearer, sk-, and key/value patterns, so newly supported credentials such as GitHub, Google, or Slack tokens can be emitted in Rive diagnostics and tool output.

Scope

• Make the core redactor the single source of truth for Rive stdout/stderr tails, error envelopes, command display, and structured values.
• Keep the existing deep-value traversal and maximum-depth guard, and preserve the current Rive helper exports where callers use them.
• Keep the command protocol and result shape unchanged.

Acceptance criteria

• Rive output and error projections never expose core-supported token forms or sensitive keyed values.
• Nested arrays/objects remain bounded by the existing depth policy.
• Existing Rive workflow tests pass, with regression coverage for at least one token form that the local implementation missed.

This is the Rive redaction slice of #1404.