fix: sanitize staged files before GitHub upload

[mimosapudical]

Summary

• sanitize staged textual artifacts at the GitHub commit boundary
• re-stage sanitized files so stale secrets cannot remain in the Git index
• verify staged blobs before commit and fail closed if recognized credentials remain
• preserve binary files and safely handle staged deletions

Closes #153.

Dependency

Depends on #169.

The first commit in this branch (90d67f5) is already under review in #169.
The new change introduced by this PR is 6fe92e0.

Once #169 is merged, I will rebase this branch onto the updated main so this PR contains only the #153 change.

Why

Previously, sanitization only covered selected files under logs/ before git add.
Secrets written to other artifacts could therefore enter the Git index.

Also, sanitizing only the working-tree file after staging is insufficient because the Git index may still retain the original secret-containing blob.

The new boundary is:

agent artifacts
→ git staging
→ staged-file sanitization
→ re-stage sanitized files
→ staged-content verification
→ commit
→ push

Testing

• python -m pytest -q tests/test_security.py — 13 passed
• python -m py_compile src/core/security.py src/core/github_manager.py tests/test_security.py — passed
• manual local Git acceptance test — fake secret absent from working tree, Git index, and committed blob

Full tests/: 178 passed, 3 unrelated existing Windows path assertion failures.