rlg-redact

PII and secret redaction for rlg records. Built-in regex patterns for credit cards, JWTs, OAuth bearers, emails, and IPv4 addresses, plus a custom-pattern API. Sits between `Log::fire()` and the sink so logs emitted to disk / OTLP / syslog are scrubbed.