fix(desktop): route Rive diagnostics through the core secret redactor

[seekskyworld]

Problem

apps/desktop/src/main/rive-cli.ts maintains a private redactRiveText implementation alongside the authoritative @maka/core/redaction rules. The local copy only recognizes a small set of bearer, sk-, and key/value patterns, so newly supported credentials such as GitHub, Google, or Slack tokens can be emitted in Rive diagnostics and tool output.

Scope

• Make the core redactor the single source of truth for Rive stdout/stderr tails, error envelopes, command display, and structured values.
• Keep the existing deep-value traversal and maximum-depth guard, and preserve the current Rive helper exports where callers use them.
• Keep the command protocol and result shape unchanged.

Acceptance criteria

• Rive output and error projections never expose core-supported token forms or sensitive keyed values.
• Nested arrays/objects remain bounded by the existing depth policy.
• Existing Rive workflow tests pass, with regression coverage for at least one token form that the local implementation missed.

This is the Rive redaction slice of #1404.

[seekskyworld]

我认领这个切片。将把 Rive 的文本与结构化值脱敏统一到 @maka/core/redaction，保留深度上限、结果协议和现有调用方，并补充核心 token 形态回归测试。实现从最新 upstream/main 独立分支开始。

[Adarsh-Me]

Take