feat(secrets): add phase 1 secrets tool and redaction hardening

Implements the first pragmatic slice of issue #3627 / #410:
- add agent-facing  tool with list/check/request/delete/inject
  actions
- reuse existing secure CLI secret capture path via getpass-backed callback
  so secret values never enter model context
- support  as an alias for the existing
   skill frontmatter
- redact execute_code stdout/stderr before returning tool output
- expand redaction patterns for Twilio SIDs and JWTs
- register the new tool in discovery/core toolsets and add regression tests

Gateway DM+delete secret capture remains scoped as follow-up work per the
Phase 1 issue discussion.

tools/code_execution_tool.py

@@ -597,6 +597,13 @@ def execute_code(
         stderr_text = strip_ansi(stderr_text)
 
         # Build response
+        try:
+            from agent.redact import redact_sensitive_text
+            stdout_text = redact_sensitive_text(stdout_text)
+            stderr_text = redact_sensitive_text(stderr_text)
+        except Exception:
+            pass
+
         result: Dict[str, Any] = {
             "status": status,
             "output": stdout_text,