fix: harden CLI inputs and provider safety

Address security audit findings:
- bound response input size for direct text, files, and stdin
- validate OpenAI-compatible base URLs with explicit insecure opt-in
- redact common secret patterns from provider/judge errors
- cap validation --runs and write sensitive artifacts with private perms
- delimit untrusted transcripts in diagnostic and crosscheck prompts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>