fix(artifactstore): redact storage errors

[XnLemon]

Objective

Close a Phase2 storage-error redaction gap by ensuring artifact store service boundaries do not expose raw storage backend errors containing credentials or tokens.

Changes

• Added a redacted storage error wrapper for external metadata/object store errors.
• Preserved errors.Is / unwrap semantics while redacting Error() output.
• Applied the wrapper to artifact metadata query/reserve/activate/delete and object get/put/delete paths.
• Added regression coverage for DSN password, Authorization bearer token, and API key leakage in storage errors.

Validation

• go test ./platform/artifactstore
• go vet ./platform/artifactstore
• git diff --check
• open-code-review subagent review: 0 High / 0 Medium / 0 Low

Known Risks / Limitations

• Error text remains intentionally sanitized; callers needing exact backend details should inspect wrapped errors through controlled internal diagnostics rather than user-facing logs/responses.

Follow-up

• Continue Phase2 closure on the next independently reviewable governance/security gap.