fix(security): merge overlapping redaction ranges

[rabesss]

Summary

Fixes #258.

Extend an overlapping credential span through the full union rather than dropping its tail. Preserve contained, disjoint and adjacent-span behavior.

Validation

• Reproduced both reported failures before the fix
• Added 15 boundary cases, a 1,296-pair coverage oracle and the encoded escaped-quote regression
• Secrets tests and race tests pass; new regressions pass 20 repetitions
• Full vet, golangci-lint v2.12.1 (0 issues), and build with -buildvcs=false pass
• Independent review found no issues

Full go test ./... was attempted. The unchanged baseline fails network-dependent client tests and nine player tests because this cloud sandbox cannot resolve example.com or bind AF_UNIX sockets. Worktree builds require -buildvcs=false due to the environment's VCS lookup. Hosted CI and Security passed on the final head: https://github.com/rabesss/impartus-cli/actions/runs/37479404062. The latest title check also passes.

This does not address the separate plain-text escaped-quote issue #257.