Fix custom redaction regex isolation

[dmoliveira]

Summary

• Execute non-default custom secret-detector regexes in bounded one-shot workers.
• Preserve the exact built-in detector profile synchronous path and existing traversal/redaction semantics.
• Enforce request-wide match-span and output-allocation budgets in worker and parent validation, with fail-closed timeout/capacity handling.

Validation

• npm test (977/977)
• Focused secret-redaction suite (46/46)
• npm run build
• npm run lint
• make validate
• pre-commit run --all-files
• git diff --check

Review

• Final implementation review: no blockers.