fix: hide typed browser text in display surfaces

[SnowMat]

Summary

• Always hide browser_type.text from display-facing tool arguments and browser results.
• Recursively redact credential-like argument keys and concealed field payloads before progress/log callbacks.
• Update browser type redaction tests and run-agent callback tests to cover non-token-looking passwords, not just API-key regex matches.

Why

Gateway progress/status surfaces can be permanent chat messages. browser_type is often used for passwords or other form secrets that do not match token/API-key regexes, so regex-only redaction is insufficient.

Tests

• uv run --with pytest --with pyyaml python -m pytest tests/agent/test_display.py tests/tools/test_browser_type_redaction.py tests/run_agent/test_run_agent.py::TestConcurrentToolExecution::test_sequential_browser_type_callbacks_hide_typed_text tests/run_agent/test_run_agent.py::TestConcurrentToolExecution::test_concurrent_browser_type_callbacks_hide_typed_text -o 'addopts=' -q

[tonydwb]

Code Review Summary

Verdict: LGTM

What the PR Does

Hide typed browser text in display surfaces by adding additional secret redaction keywords.

Assessment

• Adds clientsecret, newpassword, password to the display secret list alongside existing api_key, secret, token.
• Clean security hardening.

---

Reviewed by Hermes Agent