fix(redact): preserve code syntax around auth header redaction (#33801)

[Tranquil-Flow]

What

The \S+ greedy capture in _AUTH_HEADER_RE and _SECRET_HEADER_RE was consuming trailing code delimiters (quotes, braces, brackets, parens) when masking credential tokens. When _mask_token replaced the match, those delimiters vanished, corrupting surrounding code syntax in tool output.

Fix

Replace \S+ with _TOKEN_CHARS = r"[^\s\"'<>{}\[\]()\\,;]+" — matches everything \S+ would except common code-syntax delimiters, so redaction stops at the delimiter and the credential is still masked.

Layers addressed (all tested)

1. Bearer token closing-quote corruption
2. Basic auth closing-quote corruption
3. Proxy-Authorization closing-quote corruption
4. x-api-key / api-key header closing-quote corruption
5. Dict-literal brace corruption ({X: "Authorization: Bearer <tok>"})
6. code_file=True mode still redacts but preserves delimiters

Verification

• Fail-without-fix: 7 of 10 new tests fail on unpatched code (closing quotes consumed by \S+)
• With fix: all 92 tests pass (10 new + 82 existing)
• Redaction still works correctly in plain log lines (no surrounding delimiters)

Competitor PRs

• fix: pass code_file=True to redact_sensitive_text in execute_code and terminal #33840, fix(redact): preserve code-like tool output #34666: pass code_file=True at call sites — complementary but does not fix the AUTH_HEADER_RE regex itself
• fix(agent): restrict secret redaction to credential fields to stop corrupting code output (#33801) #39001: adds template-context detection for $VAR / ${{ secrets.X }} — complementary, does not fix the AUTH_HEADER_RE character class

This PR fixes the root regex cause; the competitor approaches address different symptoms (ENV-assignment and JSON-field corruption).

Auto-published by Moonsong via Path B automated pipeline.

[teknium1]

Closing as part of the #33801 secret-redaction-corrupts-code cluster, fixed at the root in #54061 (merged: 674e16e).

The real defect was _DB_CONNSTR_RE's password group matching greedily across newlines, corrupting displayed tool output (read_file/terminal/execute_code) for any source containing a postgresql:// f-string template. The fix forbids whitespace in the userinfo/password groups so the match can't span a line, preserves brace-only template passwords under code_file=True, and passes code_file=True at the terminal/execute_code output sites. Thanks for the contribution to this area.