fix(ci): allowlist Ascend diagnostic artifacts

[ShuhaoZhangTony]

Summary

• replace the raw Ascend benchmark environment artifact with deterministic JSON generated from an exact key allowlist
• route all environment-derived diagnostic fields through the same deny-by-default collector
• add dynamic regression tests that exclude synthetic GitHub, HF, publication, SSH, proxy, and future VLLM_* credential variables by both key and value

Root cause

collect_ascend_diagnostics wrote env | sort to the benchmark result tree. The workflow uploads that tree with if: always(), while GitHub log masking does not sanitize artifact file contents.

Validation

Implementation head: 9fabfa56572b74dd14abc852942296c1bb4f0d0a
Current head: ac878c106bcfe23807ac184ba69db0ac80316306

• focused CI suites: 40 passed
• Ruff: passed
• Python compilation: passed
• bash -n: passed
• raw environment dump scan: passed
• synthetic clean-environment redaction test: passed
• git diff --check: passed

The current head includes the tested Ascend smoke isolation from #155; this PR remains stacked behind #155 and must pass its own exact-head smoke before merge.

[ShuhaoZhangTony]

@moonandlife @iliujunn @QixinZhang26 @Renty-0 — independent review is requested for this security hardening. It replaces raw diagnostic environment capture with an exact allowlist and synthetic credential-exclusion regressions. The affected benchmark workflow remains disabled until this PR receives the required approval and merges.

[ShuhaoZhangTony]

Local maintainer validation completed at exact head ac878c106bcfe23807ac184ba69db0ac80316306: focused diagnostic allowlist/workflow suites 25 passed; Ruff, Bash syntax, and diff-check passed. Qwen2.5-7B exact-head Ascend serve smoke passed on NPU 2, and device/port cleanup was verified.