fix(audit): ScadaBridge C2 review — over-redact scrubs all sensitive free-text fields + outer-catch never-leak test + marker alignment

I1 (security): OverRedact() in ScadaBridgeAuditRedactor now suppresses ErrorDetail,
ErrorMessage, and Extra (in addition to RequestSummary/ResponseSummary) to the
over-redacted marker in BOTH code paths (Deserialize+with path and the fallback
new-AuditDetails path). SafeDefaultAuditRedactor catch block aligned to match.

M3 (test): OuterCatch_OptionsThrows_NeverLeaks_AllSensitiveFieldsOverRedacted forces
the outer try/catch → OverRedact path via a ThrowingMonitor that throws from
CurrentValue (the first statement in the try block). Asserts (a) Apply does not
throw, and (b) all five sensitive free-text fields are suppressed to the
over-redacted marker with PayloadTruncated=true.

M1 (consistency): SafeDefaultAuditRedactor now uses AuditRedactionPrimitives
constants (RedactedMarker for line-format header values, OverRedactedEventMarker
for the catch block), eliminating the divergent [REDACTED]/[redacted by ...]
strings. AuditRedactionPrimitives gains OverRedactedEventMarker = RedactorErrorMarker.
SafeDefaultAuditRedactorTests updated from [REDACTED] → <redacted>.

M2 (comment): Added one-line note in TruncateField explaining why the char-count
(result.Length != value.Length) truncation check is sufficient given TruncateUtf8
only ever shortens.

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/Redaction/SafeDefaultAuditRedactorTests.cs

@@ -43,7 +43,7 @@ public class SafeDefaultAuditRedactorTests
         var result = SafeDefaultAuditRedactor.Instance.Apply(evt);
 
         var d = Details(result);
-        Assert.Contains("Authorization: [REDACTED]", d.RequestSummary!);
+        Assert.Contains("Authorization: <redacted>", d.RequestSummary!);
         Assert.DoesNotContain("secret-token", d.RequestSummary!);
         Assert.Contains("Content-Type: application/json", d.RequestSummary!);
     }
@@ -56,7 +56,7 @@ public class SafeDefaultAuditRedactorTests
         var result = SafeDefaultAuditRedactor.Instance.Apply(evt);
 
         var d = Details(result);
-        Assert.Contains("Set-Cookie: [REDACTED]", d.ResponseSummary!);
+        Assert.Contains("Set-Cookie: <redacted>", d.ResponseSummary!);
         Assert.DoesNotContain("abc123", d.ResponseSummary!);
         Assert.Contains("X-Other: ok", d.ResponseSummary!);
     }
@@ -68,7 +68,7 @@ public class SafeDefaultAuditRedactorTests
 
         var result = SafeDefaultAuditRedactor.Instance.Apply(evt);
 
-        Assert.Contains("[REDACTED]", Details(result).RequestSummary!);
+        Assert.Contains("<redacted>", Details(result).RequestSummary!);
         Assert.DoesNotContain("x-y-z", Details(result).RequestSummary!);
     }