fix(security): scrub every serialized event string

[rabesss]

Summary

Fixes #254.

Scrub decoded JSON strings and keys at the event serialization boundary, after standard JSON marshaling. Covers nested artifacts, maps, typed Details and custom marshalers without mutating caller-owned data or changing numeric precision, benign JSON bytes, or serialization/terminal error behavior. Documents the boundary; no shared secrets-parser changes.

Validation

• Original regression reproduced before fix
• Events tests and race tests pass, including repeated independent race runs
• CLI/watch ordinary and race integration checks pass
• Full vet, golangci-lint v2.12.1 (0 issues), and build with -buildvcs=false pass
• Independent review found no issues

Full go test ./... was attempted and retains the clean-main sandbox failures: network-dependent client tests and nine player AF_UNIX socket tests. Worktree builds require -buildvcs=false because of the environment's VCS lookup. Hosted CI and Security passed on the final head: https://github.com/rabesss/impartus-cli/actions/runs/37479466827. The latest title check also passes.