[sec-bus] redact: parity with host redactors (structured-argument keys and marker, corroborated cards, encoded credentials, long prompts)

Change

RedactMode::StructuredArguments: parity with OpenHuman's 60-key list (incl. presigned-URL keys) and the <redacted: kind (n chars)> marker the UI and tests read; pattern-match secrets inside string values (host bug: curl -H "Authorization: Bearer sk-…" in command is stored verbatim).
Reproduce tinyredact::Policy::corroborated() (card numbers need an issuer prefix or nearby keyword so timestamps survive), JSON key dropping and the Sanitized<T> change report used by flows, stop summaries and artifact offload.
RedactWith: also scrub URL-encoded and base64 forms of the supplied exact credentials (Composio keys).
ScanPrompt2: define behaviour above the 64 KiB cap (chunk or Review, fail closed) — pinned recalled-memory prompts exceed it; document dropping the opt-in heuristic classifier (OPENHUMAN_PROMPT_INJECTION_CLASSIFIER=heuristic).
ScanToolDefinition: document the JSON-object input the MCP registry caller must build.
Record the boot-floor exception (ADR 0007) for synchronous Sentry before_send and pre-module logging (epic note N6).

Paths are relative to crates/openhuman-core/src/ in tinyhumansai/openhuman at main ae18f8b769.

File	Lines	Verdict	Target	Reason
`security/approval/redact.rs`	181	REIMPLEMENT	`tinysecurity_redact::Redactor::redact` `RedactMode::StructuredArguments`	Key-denylist walk. `summarize_action` (~60, product copy) stays as `summary.rs`. Gaps: 60-key parity incl. presigned-URL keys; `<redacted: kind (n chars)>` marker shape. (branch: migrated)
`security/scrub.rs`	34	REIMPLEMENT	`tinysecurity-redact` `Redactor::redact`	Pinned `tinyredact::Policy::corroborated()`. Gaps: corroborated card matching, JSON key dropping, `Sanitized<T>` change report, 64KiB cap vs memory writes. `host_policy()` (tinymemory config) moves to `memory/`. (branch: migrated)
`integrations/composio/tools/redact.rs`	142	REIMPLEMENT	`tinysecurity-redact` `RedactWith`	Exact-match key scrub; gap: encoded forms. (branch: migrated)
`security/prompt_injection/detector.rs`	529	REIMPLEMENT	`tinysecurity-redact` `score.rs::Scorer` (`ScanPrompt2`), `scan_tool_definition` (`ScanToolDefinition`)	Upstream is a faithful port. Gaps R1 (opt-in heuristic classifier dropped), R2 (64 KiB cap: host needs fail-closed long-prompt policy — blocks migration), R3 (tool-definition takes JSON object). Host keeps `enforce_prompt_input` shell. (branch: migrated)
`core/log_redaction.rs`	114	REIMPLEMENT	`tinysecurity-redact` `RedactMode::CredentialsOnly`; boot floor per tinysecurity ADR 0007	Sync Sentry before_send + pre-module logging need a host boot floor; rest goes over the bus. (branch: partial)

None.

The capability above is merged to the canonical repository's main with tests, and (for a release leaf) published with a checksum.toml.
The repository's own CI is green on Linux, macOS and Windows.
OpenHuman's matching host rows can be deleted against this release (tracked by the adoption leaf).

Files to consider: the rows above and the OpenHuman host code they replace (paths in the rows).
Research: the gaps and line references in the Change section; re-read each cited line on current main before editing, the audit is a snapshot.
Workflow: an implementing-an-epic step for Tracker: security, policy, approvals and sandboxing onto tinysecurity + tinybox (file-by-file migration epic) tinyhumansai/openhuman#8369. Follow migrate-to-submodule (bus contract only, upstream PR first, release, then digest re-pin from the published checksum.toml).
Subagent: tdd-implementer.

Merged in #17 (7c8c24b)