Harden watcher security and sync handling

[abpai]

Summary

• harden watcher marker files by creating private temp directories and cleaning them up as a unit
• respect commander report/setup toggles, including --no-enrich and provider-specific AI config fields
• reduce secret exposure by trimming git diff context, redacting sensitive context lines, and keeping dashboard API keys in memory only
• reuse the watch pipeline database for sync runtime backfill and periodic sync instead of opening a second connection

Verification

• bun test src/commands/activity-report.test.ts src/commands/setup.test.ts src/capture/platform/marker-files.test.ts src/enrichment/redact.test.ts
• bun test src/server/server.test.ts
• bun test src/capture src/runtime
• bun x tsc --noEmit

Notes

• No data migrations required
• .agents/LEARNINGS.md remains local and is not part of this PR