Scrub [Secret] values from all log output (plugin-SDK prerequisite)

[ChrisonSimtian]

Problem

[Secret] (src/Fallout.Build/ParameterAttribute.cs:76) is a passive marker only — there is no SensitiveValueRegistry or output scrubber anywhere, so resolved secret values are never masked from logs. docs/adr/0002-cross-provider-auth-and-secret-conventions.md rule 6 ("log masking is a framework-level service") flags this as open; the plugin SDK makes it blocking.

Outcome

Values resolved into [Secret]-marked fields never appear in any build output — framework or plugin — so a third-party plugin cannot leak a resolved secret to CI logs.

Acceptance criteria

• A central SensitiveValueRegistry (or equiv) registers every value injected into a [Secret] field, at injection time (value-injection middleware / IOnBuildCreated).
• Logging middleware scrubs registered values from stdout, stderr, target logs, and the build summary before write.
• Scrubbing covers plugin-emitted output, not only framework output.
• Test: a secret written via Log, Console, or target output does not appear in captured output.

Notes

• Gates the plugin foundation: milestone Add CodeQL workflow for security scanning #7 runs third-party plugins in-process at full trust (RFC [RFC #4] Plugin discovery and load model #100). ADR-0002's "plugins receive resolved values, never raw stores" boundary is porous without this.
• Foundation epic [Foundation] Epic: Engine de-statification & extension-pipeline formalization (plugin foundation) #315; design context in docs/plugin-extraction-github.md (round 5).

Open questions

• How to handle transformed secrets a plugin derives (base64, URL-embedded) — scrub only the literal, or registered variants too?