fix(streaming): mask credentials in streaming responses under the same opt-in

[maxmad64bis]

⚠️ base-red inherited: #15306

Summary

When the opt-in is on, non-streaming responses mask secrets while streaming responses pass them through in clear text, because the streaming pipeline has no credential step. This change pipes streamed chunks through the same credential check when the existing opt-in is on, so keys and connection strings arrive masked on both paths and bytes stay untouched when it's off or opted out.

Related Issues

• No linked issue — reproduced on the release base

Target Branch

• Base is the active release/v3.8.x branch (the highest open release/v*), not main
• New feature? From 3.8.55 on it is held with the v4-feature label for the v4 channel

Validation

• Change type: other
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/streaming-credential-transform.test.ts — covers masking on content and tool arguments, plus image data URLs and split secrets
• tests/unit/chatcore-streaming-pipeline.test.ts — covers pipeline order and the gate staying off by default, off, and under opt-out
• tests/unit/sseTextTransform.test.ts — covers routing tool arguments to the processor when the new flag is on

Coverage Notes

• src/lib/streamingCredentialTransform.ts — covered by tests/unit/streaming-credential-transform.test.ts
• open-sse/handlers/chatCore/streamingPipeline.ts — covered by tests/unit/chatcore-streaming-pipeline.test.ts
• open-sse/handlers/chatCore/streamingTail.ts — covered by the gate tests in tests/unit/streaming-credential-transform.test.ts
• src/lib/sseTextTransform.ts — covered by tests/unit/sseTextTransform.test.ts

Reviewer Notes

• Behavior: masking is opt-in and matches non-streaming; a real key inside an image data URL stays unmasked, which is the pre-existing guardrail's limit.