fix(diag): a bundle identifier is redacted by the key that names it

[Behnam-RK]

Closes #65. Closes #63.

#65 — the independent read of 3001e6d

3001e6d merged after the last hosted review of #55 (4112501), so nobody read it.
The prior was that a change of that shape carries a leak. It held — five defects:

• Two identities could share one placeholder. The ordinal was the count of
  order entries for a kind, so a refusal — which advances the token but appends one
  entry — vacated a number and reissued it. profile-1 refused its way to profile-2,
  then alpha counted one entry and was also given profile-2. One token, two servers,
  and a legend reading 2 distinct profile names → profile-2 … profile-2. A bundle that
  reports two servers as one looks like a working bundle until someone diagnoses with it.
• The legend advertised tokens that were not in the bundle. A skipped ordinal makes
  the tokens non-consecutive, and a range promises everything between its ends — the same
  lie the old 1..n rendering told, moved to the interior. Range when consecutive, list
  otherwise.
• knownNames could launder its own tokens, which json.go asserted was impossible.
  The replay sorts longest-first, so a value spelled like a token had the pair
  (profile-1 → profile-2) applied to text the replay had just written.
• placeholderRe had lost the iface kind — it is generated from one list now.
• ifaceAttrRe matched tunnel=, which nothing in the tree writes.

#63 — both halves, because the issue's half alone does not reach it

The issue proposed fixing this at the source: stop interpolating identifiers into prose.
That is necessary and not sufficient — the entries that actually leaked are
rules-preview.txt and log.txt, a rendered pf/nft ruleset and slog records. A pf rule
carries an interface as pass out quick on { nordlynx } because that is what a pf rule
is, and an OS error string is written by the OS.

So both:

• knownNames now replays interface names, which nothing did. nordlynx was shipping
  verbatim in a default redacted bundle from the rendered rulesets, doctor's prose,
  state.json's tunnel detail and the log. reserved gains vpn, tunnel and
  wireguard first — keepIface keeps only a generic stem plus digits, so an interface
  can legitimately be called those, and the replay would have rewritten dezhban's own words.
• Text is now the replay plus the shape passes; shapes is what a caller says when it
  wants the shape passes alone. Every external caller wanted the replay, so a second door
  would only have left the wrong one reachable.
• At the source, doctor.json's details carry the identifier as a field under a key the
  walk already knows, with both renderers composing the sentence. state.json publishes
  one entry per tunnel interface — a comma-joined name minted one token for the pair
  and stopped keepIface seeing the generic half as the kernel's.

ADR-0016 records why prose keeps
its identifiers where we do not author the text, so the next round does not re-litigate it
from issue comments.

Review loop

Four rounds ran over this branch. Every defect after round 0 was in code the loop itself
wrote — the branch's own behaviour has been clean for three reviewer rounds. Naming them
rather than absorbing them:

Round	Reviewer	Scope	Findings	Pre-existing	Loop-introduced	Defects fixed
0	me, before asking	whole branch	3	0	3	3
1	read-only subagent	whole branch	4	1	3	0
2	read-only subagent	what the loop wrote	6	0	6	0
3	me + read-only subagent	the slice round 2 missed	2	0	2	1
4	me + read-only subagent	prose vs code, whole branch	1	1	0	1

Regressions the loop introduced and then fixed:

• rollback assigned the checkpoint's own map, so the Redactor mutated it on the next mint.
• The app's Overview rendered up (up) and read .first, hiding every interface but
  one once state.json started publishing one entry each.
• Two tests did not bite: one passed against the old two-group ifaceAttrRe, and one
  passed only because an earlier row of its own table had minted first.
• A comment claimed an invariant "cannot" break and then guarded against it breaking.

Round 4 covered a dimension the first three never did — whether the prose this branch
ships is true of the code — and found one real defect in the page that is compiled into
the macOS app: docs/usage/cli.md claimed "a token is never the spelling of a name in
the bundle". False in the residual this package already documents, and actively
misleading: an interface called profile-1 ships verbatim while the legend beside it
says profile-1 is a redacted profile name, so the one thing a reader can do with it is
read an interface name as a redaction. The page now states the guarantees that hold and
the case that is not covered, pinned by TestANameSpelledLikeAnExistingTokenKeepsItsSpelling.

One finding was declined with evidence: scoping the minted guard by kind. It reads as
a tightening and is a regression — a name that is both a profile and an endpoint is replayed
as profile-1 into host=…, and a kind-scoped guard mints host-2 for it: a token standing
for a token, plus a phantom legend row. Recorded in ADR-0016's Risks and pinned by
TestAReplayedTokenIsNotReMintedUnderAnotherKind.

Verification

task check, GOOS=linux/windows go vet, swift test (270, was 263). Every new test was
run against the code it guards to confirm it fails there.

Plus a real dezhban report over a fixture carrying a vendor interface, a single-label
endpoint and a profile literally named profile-1:

• nothing leaks — grep -ri 'nordlynx\|mullvad\|protonvpn' over the unpacked bundle is empty
• rules-preview.txt reads pass out quick on { iface-1 utun4 }
• the real profile named profile-1 appears nowhere, and no token stands for two identities
• every JSON entry parses; utun4, lo0, private subnets, the posture strings and doctor's
  check names all survive
• --include-network still returns all of it, and says so

Not in scope

control.Group is still written into doctor prose unredacted. It is the same value
config.json ships in the clear, so redacting it only in one place would be incoherent —
it needs its own decision about whether unix group names are identities.

🤖 Generated with Claude Code