fix(security): redact secrets from remote-agent deploy payload

[joshpalerlin]

Summary

• Fixes secret exposure in the remote-agent deploy payload — environment variables (including API keys, tokens, and credentials) were being passed in plaintext when launching agents
• Introduces typed DeployPayloadContext to structurally enforce redaction of all three environment maps (system, user, provider) before they leave the host
• Resolves clippy argument-count lint without suppression
• Updates docs/remote-agents.md Known Defect 3 to mark the launch-payload and three-map redaction as resolved

Test plan

• All 2,114 Desktop library tests pass (verified by Sol in Docker with Rust 1.95)
• cargo fmt --check passes
• cargo clippy --all-targets --all-features -- -D warnings passes
• Two new backend redaction regression tests pass
• Four-file scope verified: agents_deploy.rs, agents_tests.rs, managed_agents/backend.rs, docs/remote-agents.md

Review

Independently reviewed by Sol across 3 rounds — HARD PASS verdict on final round.

🤖 Generated with Claude Code