redact: control.sock is redacted as a hostname, so the control check's path reads as `host-N`

[Behnam-RK]

doctor's control check names the socket it probed, and the redactor replaces that filename with a hostname token. In a default (redacted) bundle, doctor.json reads:

"summary": "reachable (/var/db/dezhban/host-1, group \"vpnadmins\") — routine ops need no password."

The path is the answer to "which socket did it probe", and it is dezhban's own filename, not the user's. Redacting it throws away the diagnosis and hides no identity — the direction docs/contribute/testing.md already calls out:

a bundle that hides the diagnosis has thrown away the answer and hidden no identity

It also inflates the legend by one hostname that stands for a filename.

Why it happens

control.sock satisfies hostRe (internal/redact/redact.go): dotted, with an alphabetic last label. keepHost then consults keptSuffixes, which lists .json, .log, .txt, .plist, .dezhban, .arpa, .invalid, .test — and not .sock.

.sock meets both membership rules that list already states: it is not a real delegated TLD, and the name in front of it is dezhban's rather than the user's. control.sock is the default (controlSocketPath), so this fires on an ordinary host with no unusual configuration.

Not a regression

Reproduced against v0.14.0's internal/redact, so it predates #67:

v0.14.0 doctor summary -> "reachable (/var/db/dezhban/host-1, group \"vpnadmins\")"

Fix

Add .sock to keptSuffixes. Worth checking the same list against every other filename dezhban writes and then quotes back — the .plist entry suggests this has been hit once before.

A test belongs beside TestDezhbanFilenamesAreNotHostnames (internal/redact/redact_test.go), which is where .json/.log/.plist are already pinned.

Found while probing the redactor after #67.