fix(rustd): redact secrets from Debug; finish the retirement sweep

REVIEW findings, all fixed.

P0 — three wire types carried a secret and derived Debug, so a single {:?} on a
lease would put the provider api_key, the tenant's whole secrets_map, the minted
credential and the runner's bearer token into a log line.
protocol_credentials.zig says of that last one, verbatim, that it "is secret
(VLT) — never logged, never echoed into a frame". ExecutionPolicy,
RegisterResponse and MintCredentialResponse now implement Debug by hand in one
module, so "are secrets redacted?" has one place to look. Redaction is a Debug
concern only — Serialize still emits the real value, because these types exist to
put it on the wire, and tests assert BOTH halves so a future edit cannot fix one
by breaking the other. The secrets_map is redacted to an entry count rather than
its keys: a key names an integration the tenant has connected.

The retirement left more behind than the first sweep caught: 34 make variables
defined for lanes that no longer exist, seven help entries advertising deleted
targets, and an orphaned test-support module. The help entries were the
user-visible half — `make help` sent a developer straight to "No rule to make
target". test_zig_lanes_absent only matched invocations, so it missed all of it;
it now also matches help advertisements, and tightening it immediately caught
three entries this commit had otherwise missed.

Coverage goes to 100% lines and 100% functions, and the codecov floor moves from
95 to match. These crates carry no input/output, no runtime and no external
dependency, so every line is reachable from a test and a floor below what the
suite achieves is slack nobody asked for — the TypeScript packages already hold
exactly this bar. Closing the last five lines meant covering the unused accessor,
the non-object secrets_map arm, and the backtrace render, which needs
RUST_BACKTRACE set. Backtrace::capture reads that once per PROCESS, so the test
re-executes its own binary with the variable set rather than contorting the
production code to make the branch reachable.

166 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>