redaction: attachment secret check reads raw text only; some escaped, quoted and base64 shapes are shown #996

Found by the second review of #921 round 7. All four are measured on main and are the same at #921's head. The exact inputs are held privately (#707).

1. The attachment secret check reads only raw text. secretKinds, which the chat attachment refusal uses, matches each pattern on the raw text. It has no glue points and no union with the redactor's shapes. So some secrets that redactString hides (a token glued after a terminal escape or a word prefix, or a credential after a newline) give no kind, and the attachment is stored without the refusal. That it can then be served raw is inferred.
2. Escaped forms. A bearer token written with JSON-escaped slashes is only partly hidden.
3. Other-language quoting. A password in a single-quoted dictionary literal is shown in both modes.
4. Base64 variants of a JWT. JWTs with padding, or with standard-base64 characters, are shown.

Fix, by design:

• secretKinds and redactString share one matcher, the same rules applied at the same glue points. The attachment check then can never find less than redaction hides.
• Add rows for 2–4 to the redactor's shape tables.
• A test should assert that, for every shape the redactor hides, secretKinds is non-empty.

Related: #889 and #921 (shared redactor), and #988.