fix(drift): redact free-text reason before ledger writes and observer fan-out

[fu351]

Slice

• Feature / Slice: F10 hardening — issue Redact the free-text reason before it reaches the drift ledger and DriftObservers #80 (found during the PR feat(policy): gated enforce/monitor/off change primitives + PolicyDoc.enforcement (F10) #72 security review)

Closes #80

What this PR does

The reason parameter of apply_change / apply_enforcement_change / log_change was written verbatim to the policy-change ledger and fanned out unredacted to DriftObserver plugins — contradicting the module's own "observers receive redacted events" promise. A pasted token in a reason would have been persisted and shipped to any enterprise sink.

Adds _redact_reason, applied once at the entry of each chokepoint so the scrubbed value flows everywhere (ledger, observers, rendered confirm diff):

• Reuses the existing detectors from doberman.engine.rules.secrets (credential-shape patterns + high-entropy heuristic) — no new detection logic; lazy import, policy→engine is within the import contract (lint-imports green).
• Redacts before truncating (a secret straddling the cap is still fully scanned), then caps at 300 chars.
• Fails safe: any internal error stores the fixed placeholder [reason redaction failed] — never the raw string, never raises.

Tests added (run in CI)

tests/unit/test_drift_reason_redaction.py (9): synthetic AWS key + high-entropy token never appear in ledger rows or observer events across all three paths; pass-through for normal reasons; truncation; empty string; monkeypatched redaction failure → placeholder stored, call still completes.

Security checklist

• Fails closed on error (placeholder, never raw)
• No secret logged or persisted (that's the point; tested end-to-end)
• Raise-only untouched (redaction never alters classification/gating)
• lint-imports 2/2 contracts kept