fix(secrets): mask underscore-adjacent credential key names

[galuis116]

What changed

_ASSIGNMENT in src/vouch/secrets.py now delimits its credential-keyword
alternation with alphanumeric lookaround ((?<![A-Za-z0-9])...(?![A-Za-z0-9]))
instead of \b...\b, so it matches keywords inside underscore-delimited
names like access_token, client_secret, DB_PASSWORD, and
AWS_SECRET_ACCESS_KEY.

Why

\b treats _ as a word character, so \btoken\b never matches token
inside access_token — the _↔t transition is \w→\w, never a
boundary. Same for secret inside client_secret and password inside
DB_PASSWORD. Since snake_case / SCREAMING_SNAKE_CASE is the dominant
real-world shape for credential env-vars (.env files, shell export,
docker-compose), this excluded the majority of actual credentials from
masking — only a bare token=/secret=/password= with no prefix or
suffix was ever caught.

This regex backs two live call sites: the capture-time guard (a secret
that reaches the buffer is permanent, per the module's own docstring) and
lifecycle.redact(), the manual remediation backstop for a credential
that already reached a durable claim. Both were silently missing the
common case.

Fixes #646

What might break

Nothing for users with an existing .vouch/ directory — no on-disk shape,
kb.* method, or object model change. Behaviorally, mask_secrets() now
redacts more inputs than before (strictly a superset): any text that
previously matched a bare keyword (token=, password=, etc.) still
matches identically; text with a snake_case-prefixed/suffixed keyword
(access_token=, DB_PASSWORD=) now also matches, where it previously
passed through untouched. No previously-masked case becomes unmasked.

VEP

Not applicable — no object model, kb.* method, on-disk layout, bundle
format, or audit-log shape change. A regex-correctness fix inside a single
pure string function.

Tests

• make check-equivalent locally: ruff clean; mypy clean on
  secrets.py; all 19 tests/test_secrets.py cases pass (17
  pre-existing + 2 new). Also ran the directly-affected
  test_capture.py, test_capture_answer.py, test_capture_scope.py,
  test_cli_lifecycle_surface.py, and test_lifecycle.py suites —
  one pre-existing failure (test_finalize_supersedes_updated_claims)
  confirmed present identically on test HEAD before this change
  (via git stash comparison), unrelated to secrets.py
• New / changed behaviour has a test —
  test_masks_underscore_adjacent_key_names,
  test_underscore_boundary_change_has_no_new_false_positive
• CHANGELOG.md updated under ## [Unreleased]

[galuis116]

added a second, unrelated commit: ruff check src tests was red for every open PR against test right now (a duplicate test_build_excludes_archived_followups name in tests/test_digest.py from two independently-merged fixes, F811). renamed the shadowed one instead of deleting it, so both scenarios still run. flagging in case it is worth a heads-up to other in-flight PRs too.