feat(config,tui): confirmed opt-out for model-bound key redaction

The model boundary masks credential-shaped tool output before it reaches an
upstream model (configured secrets plus a CredentialShaped structural pass).
Editing files that contain real credentials has always been awkward because
the model cannot quote those bytes back. This adds a deliberate, documented
opt-out that treats lowering the boundary as a security decision:

- config.toml gains [redaction] model_bound = "enabled" (default) | "disabled";
  "disabled" only records a request.
- After a restart the interactive TUI shows a full-screen startup gate (same
  explicit-key discipline as workspace trust: 1/Y confirm, 2/U keep, 3/N/Esc
  quit; Enter never confirms by reflex).
- Confirming persists a receipt to ~/.codewhale/redaction-state.json and
  rebuilds the engine so its client applies the opt-out. Until a receipt
  exists every process - including headless/exec runs - stays masked.
- The client opt-out covers structured ToolResult blocks only; routing/
  classification summaries and durable goal-state text keep always-on
  redaction.
- Gate copy is localized across all 15 shipped locale packs; enum, JSON, and
  ALL_MESSAGE_IDS stay in sync.

Author: SparkofSpike

config.example.toml

@@ -206,6 +206,33 @@ memory_path = "~/.codewhale/memory.md"
 # max_reprompts = 2
 # reprompt_message = "So, what's up ? Keep running !"
 
+# ───────────────────────────────────────────────────────────────────────────
+# Model-bound key redaction ([redaction])
+# ───────────────────────────────────────────────────────────────────────────
+# Codewhale masks credential-looking values in tool output before it reaches
+# the model (the "model boundary"), so a file that contains a configured API
+# key, a bare provider token, or a credential-shaped opaque string never leaks
+# those bytes to the model. Leave this enabled unless the model must read and
+# edit files that contain real credentials.
+#
+# Disabling is a security decision, so it is never a plain flag:
+#   * Set model_bound = "disabled" here, restart Codewhale, and the startup
+#     gate asks twice - a first confirmation, then a red "are you really
+#     sure?" stage. Only the second confirmation takes effect, and it applies
+#     on later launches while model_bound stays "disabled".
+#   * Going back to "enabled" - or rewriting config.toml after the
+#     confirmation - invalidates it: requesting "disabled" again always
+#     asks for a fresh confirmation.
+#   * Until a confirmation exists - including in non-interactive/headless
+#     runs, which never confirm anything - masking stays on regardless of
+#     this key. Choosing "keep masking on" on the gate leaves the key
+#     untouched, so the next launch asks again.
+#   * The value is forgiving: false/"off" mean "disabled"; true/"on" mean
+#     "enabled".
+# [redaction]
+# model_bound = "enabled"    # mask keys before they reach the model (default)
+# model_bound = "disabled"   # request the opt-out (restart + confirm required)
+
 # Native tool catalog controls (#2076). By default only the core tool surface
 # is loaded into the model context; less common native tools are discoverable
 # through ToolSearch and loaded on first use.

crates/config/src/lib.rs

@@ -14,6 +14,7 @@ pub mod provider;
 mod provider_defaults;
 mod provider_kind;
 pub mod provider_templates;
+pub mod redaction;
 pub mod resolve;
 pub mod route;
 pub mod settings_schema;
@@ -920,10 +921,29 @@ pub struct ConfigToml {
     /// [`WorkflowConfigToml::default`].
     #[serde(default)]
     pub workflow: Option<WorkflowConfigToml>,
+    /// Model-bound credential redaction policy (`[redaction]`). When absent,
+    /// masking is enabled — the shipped security default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub redaction: Option<crate::redaction::RedactionToml>,
     #[serde(flatten)]
     pub extras: BTreeMap<String, toml::Value>,
 }
 
+impl ConfigToml {
+    /// The requested model-bound masking mode, defaulting to enabled.
+    ///
+    /// The request only takes effect once the interactive TUI has recorded a
+    /// confirmation on its startup gate; see
+    /// [`crate::redaction::effective_masking`].
+    #[must_use]
+    pub fn redaction_model_bound_masking(&self) -> crate::redaction::ModelBoundMasking {
+        self.redaction
+            .as_ref()
+            .map(crate::redaction::RedactionToml::model_bound_masking)
+            .unwrap_or_default()
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum ProviderConfigField {
     ApiKey,