test(cli): enforce redaction across migrate and pull commands

[scottescue]

Outcome

End-to-end CLI tests prove that migrate, Pull, and Pull with Init never expose credentials, raw secret literals, unrestricted object names, or unsafe structured payloads.

In scope

• CLI stdout, stderr, formatted errors, diagnostics, and exit paths.
• Migrate, Pull, and Pull with Init success and failure scenarios.
• Broad-scan, secret-literal, credential-resolution, cancellation, and cleanup failures.
• Assertions against raw values and encoded/quoted variants.

Out of scope

• Session-level redaction already covered by lower-level conformance tests.
• Logging systems outside the built-in CLI boundary.

Acceptance criteria

• Representative credential and secret values are absent from every captured output channel.
• Broad-scan failures expose counts and safe categories without full object names.
• Structured diagnostics and formatted errors enforce the same redaction contract.
• Migrate, Pull, and Pull with Init retain actionable stable error codes after redaction.
• Tests run deterministically with injected stores, sessions, and introspection fixtures.