Redact node text consistently on every console

Follow-up from Task 9011's security review (nits, out of that task's scope). Node-authored text now reaches more console surfaces; make its redaction uniform. - `WorktreeOut.destroy_error` (apps/api/app/routes/portfolio.py) still serves the node's raw refusal beside the redacted `destroy_node_error`; redact it for tenant readers or drop it now that the web reads `destroy_node_error`. - `fleet_verdicts.redact_node_detail` does not catch bare tokens (a forge PAT shape, an `Authorization:` line, `?access_token=`); add a token-shape pass, since its output now reaches `wait_reason` at `tasks:view`. - Control plane output lines (`cp_ecs.task_output`) are served verbatim to operators; run each through the same scrubber. Out of scope: changing which surfaces show node text; any page redesign. Done means: - A tenant reader never sees an absolute path or URL credential in `destroy_error`. - `redact_node_detail` removes a PAT-shaped token and an Authorization header value (unit tests). - `GET /api/control-plane/ecs/tasks/{id}/output` lines pass through the scrubber (test).

redact_node_detail now strips PATs, Authorization values and access tokens; tenants read destroy_error redacted; CP ECS output lines are scrubbed. Quick gate and tests green, lane merged #6653 (82803d9). Its deploy was superseded by later merges. Memory: none applied.