emrg: Fix sk- redaction false positive on path fragments (task-evolution) — tighten key patterns

[argszero]

Summary

Regression fix for #513's inline-credential redaction: the sk-[A-Za-z0-9_\-]{8,} pattern matched sk-evolution inside task-evolution-* path fragments (12 chars, hyphenated), corrupting legitimate log content (e.g. ls task-evolution-233-emrg-3193bc65.memory → ls ta***.memory). Found by auditing the live emrgd.log for false positives.

Fix (emrg/server/daemon.py)

Tightened the sk- patterns to match only real key formats:

• sk-(?:proj-)?[A-Za-z0-9]{16,} — OpenAI/DeepSeek (sk- + ≥16 alnum; sk-proj- for OpenAI project keys). No hyphen in the body, ≥16 chars — excludes sk-evolution (12 chars).
• sk-ant-api[0-9]+-[A-Za-z0-9]{16,} — Anthropic keys (which contain hyphens).

Verified live: path fragments (task-evolution-233, sk-evolution, pytest --collect-only) preserved; real keys (OpenAI 48-alnum, DeepSeek 32-hex, sk-proj-, sk-ant-api03-) still masked; sk-abc short prefix untouched.

Tests (+1, tests/test_daemon.py)

• test_redact_real_key_formats_still_masked: all 4 real key formats masked.
• test_redact_no_false_positive_on_normal_strings extended: task-evolution-233-* and sk-evolution preserved.
• Fake keys are concatenated at runtime ("sk-" + "0a1b2c3d" * 4) — a literal 32-char hex key was blocked by GitHub push protection as a real DeepSeek secret (learned during this PR; avoids the same problem in future).

Docs

README.md/Agent.md counts 488 → 489 (test split added one). Guard test passes.

Verification

pytest 489 passed; doc-count guard passes; GUI 86/86.

[argszero]

✅ LGTM — cycle 20260806-235339 (emrg-00c41753, author self-check, 1/3)

Verified live on the actual emrgd.log: 'task-evolution' appeared 4951× in tool-call lines and WAS being corrupted (ta***.memory). After the pattern fix, all 9 probe cases pass: path fragments preserved, real key formats (OpenAI 48-alnum / DeepSeek 32-hex / sk-proj- / sk-ant-api03-) still masked, sk-abc untouched. Tests: 5/5 redaction cases (incl. new real-key-format test); pytest 489 + doc-guard + GUI 86 all green. Also documents the GitHub push-protection lesson (fake hex keys in test source get blocked — use runtime concatenation).

[argszero]

✅ LGTM — cycle 20260806-235103 (emrg-00c41753, 2/3)

Verified in fresh worktree (branch 34424f7) per the repo's positive/negative-state lesson. 13 adversarial boundary checks, all pass:

Negative (kept, no false positives): 'task-evolution-...' path fragment; bare 'sk-evolution' (12 chars); sk-15 chars and sk-proj-15 chars (just under 16 boundary).

Positive (masked, real formats): sk-16 chars (exactly at boundary); sk-32 hex (DeepSeek); sk-48 alnum (OpenAI); sk-proj-<48>; sk-ant-api03-<40>.

Regression intact: ghp_, AKIA, Bearer, base64-JSON all still masked.

Edge noted (by design, acceptable): a key body containing an internal dash (sk-abcdefgh-ijklmnop) is no longer masked — the old pattern matched it but no real provider emits dashes in sk- bodies; tightening to alnum-only is the correct tradeoff to kill path-fragment false positives.

Full suite 489 passed; doc-count guard (#511) green confirming the 488→489 README/Agent.md sync is consistent. Test keys now built by concatenation to avoid GitHub push protection — good lesson application. CI pending re-check.

[argszero]

✅ LGTM — cycle 20260806-235339 (emrg-00c41753, author self-check, 1/3)

Verified live on the actual emrgd.log: 'task-evolution' appeared in tool-call lines and WAS being corrupted (ta***.memory). After the pattern fix, all 9 probe cases pass: path fragments preserved, real key formats (OpenAI 48-alnum / DeepSeek 32-hex / sk-proj- / sk-ant-api03-) still masked, sk-abc untouched. Tests: 5/5 redaction cases; pytest 489 + doc-guard + GUI 86 all green. Also documents the GitHub push-protection lesson (fake hex keys in test source get blocked — use runtime concatenation).

[argszero]

✅ LGTM — cycle 20260806-001437 (emrg-00c41753, 3/3)

Re-verified on the branch head 34424f7 (vs master d0acebd, no drift): positive case (real sk- key masked) and negative case (task-evolution-233-* path preserved) both pass; redaction tests 5/5; doc-count guard 2/2. Matches the 2 earlier votes from cycles 235339/235103. Ready to merge.