fix(redaction): merge overlapping spans to redact full union

[radimsem]

Closes #240.

Problem

Redactor.Scrub dropped any hit whose Start < lastEnd. For partial overlap (A.Start < B.Start && A.End < B.End) this left s[A.End:B.End] un-redacted — a silent secret leak. The accept-loop treated all overlap as "shadow and drop", which is only correct for containment.

Fix

Replace drop-on-overlap with the standard interval merge: extend the previous accepted span's End to max(prevEnd, h.End) instead of dropping the later hit. Every byte flagged by any pattern is now redacted. The anchor (earliest-start) kind labels the merged span (a single union redaction, as the issue suggested) — no new kind, no API change.

Verification

• New TestScrub_MergesPartialOverlap reproduces the issue's exact repro: old code emitted «redacted:short»FGHIJKL trailing (leak); now «redacted:short» trailing. Confirmed red→green.
• Containment behavior preserved (TestScrub_OverlapPrefersLonger still reports one container hit).
• make build · make test (all packages) · internal/redaction 114/114 · make lint 0 issues · 15s FuzzScrub no crashers.

Note

KindCounts reports only the anchor kind for a merged multi-kind span — a deliberate, minor observability trade-off for a rare overlap edge case, not a defect.

🤖 Generated with Claude Code