channel/A2A/MCP config Serialize leak cohort: TelegramConfig.token and 5 siblings still plaintext (Serialize sibling of #6006)

[bug-ops]

Description

PR #6165 (closing #6006) fixed the Serialize leak for IbctKeyConfig, IbctKey, and McpTransport by replacing derived Serialize with hand-written redacting impls. During that fix's security audit, a same-defect-class cohort was identified and intentionally scoped out: structs with a custom redacting Debug (fixed by #6005/#6004) but a derived (plaintext) Serialize on a secret field:

• TelegramConfig.token (crates/zeph-config/src/channels.rs)
• DiscordConfig.token / application_id (crates/zeph-config/src/channels.rs)
• SlackConfig.bot_token / signing_secret (crates/zeph-config/src/channels.rs)
• A2aServerConfig.auth_token (crates/zeph-config/src/channels.rs)
• McpServerConfig.env / McpServerConfig.headers (crates/zeph-config/src/channels.rs) — the config-shape sibling of McpTransport (values here are typically vault-refs, so lower sensitivity, but same latent pattern)

Why this is harder than #6006

Unlike IbctKeyConfig/IbctKey/McpTransport (which had no serialize-to-persistence path today), these six fields do legitimately serialize to TOML via the --init wizard's config-generation step. A blanket redacting Serialize (the fix used in #6165) would corrupt generated configs by writing "[REDACTED]" into the saved TOML instead of the real value.

Expected Behavior

Each field needs per-field assessment before a fix is chosen, e.g.:

• Confirm which fields are vault-ref-only in practice (already-safe) vs. can hold raw secret values from the wizard.
• For fields that can hold raw values and must round-trip through --init, evaluate the "split shape" approach from Serialize path still leaks secret material for IbctKey(Config)/McpTransport after PR #6005 #6006's issue (option 2: separate config-persistence shape vs. redacted-diagnostic shape) rather than a blanket redacting Serialize.

Environment

• Identified as a known, explicitly scoped-out cohort during the Serialize path still leaks secret material for IbctKey(Config)/McpTransport after PR #6005 #6006 security audit (PR fix(security): redact secret fields in IbctKey(Config)/McpTransport Serialize #6165).
• General defect class: secret-bearing struct with insufficiently defended Debug/Serialize, tracked informally across 12+ prior instances in this project.

Logs / Evidence

• crates/zeph-config/src/channels.rs (TelegramConfig, DiscordConfig, SlackConfig, A2aServerConfig, McpServerConfig)
• Serialize path still leaks secret material for IbctKey(Config)/McpTransport after PR #6005 #6006 / PR fix(security): redact secret fields in IbctKey(Config)/McpTransport Serialize #6165 (Serialize fix for the IbctKeyConfig/IbctKey/McpTransport sibling)