fix: redact CLI transport diagnostics

[chubes4]

Summary

• redact generic credentials, authorization/cookie headers, credentialed URLs, secret query parameters, and known environment values before bounding child-process diagnostics
• remove stdout/stderr from successful synchronous metadata and keep failure details in bounded, redacted WP_Error data instead of error messages
• cover sync, timeout, and detached boundaries plus multiline output, truncation order, configured values, and false-positive resistance

Validation

• php tests/smoke-cli-transport.php
• bash tests/cli-transport-install.sh
• PHP syntax checks for the transport template and smoke test
• bash -n across all repository shell scripts
• git diff --check
• full tests/*.sh suite run; it exposed an unrelated existing late-assertion failure-gate defect tracked in test: source-mode assertions after failure gate do not fail CI #344

Closes #341