feat: post-run secret redaction on container output before push/post

[eshulman2]

Problem

After the container exits, Forge proceeds directly to git push and Jira comment posting with no check that the agent didn't accidentally write secrets (API keys, tokens, credentials) into committed files or generated artifacts.

Proposed solution

After container exit and before git push in the worker:

• Run gitleaks or equivalent over the diff (git diff HEAD)
• If secrets are detected: block the push, log findings with ticket key and container name, transition ticket to forge:blocked
• Optionally: scan any content being posted to Jira (PR body, comments) through the same pipeline

Reference

Learned from fullsend's output security pipeline: internal/cli/run.go:scanOutputFiles(), which scans all extracted files and redacts findings before they reach external systems.