feat: add bounded context selection and redaction

[EmersonBraun]

Summary

• Adds deterministic isolated-snapshot context selection with repository-relative include/exclude glob patterns.
• Recognizes application code plus Docker, Make, workflow, Terraform, JSON/TOML/YAML, SQL, GraphQL, and related configuration files.
• Denies sensitive/generated paths, detects binary/oversized inputs, rejects symlink escapes, and reports every skipped path as UNREVIEWED without truncation.
• Applies high-confidence secret redaction for remote/unknown provider boundaries while preserving file/line context; --allow-unredacted is local-only.
• Keeps prompt as the default and allows safe isolated-snapshot context in CI.

Validation

• npm run check
• npm pack --dry-run
• 47/47 tests passing

Closes #44