feat: add SDK diagnostics and observability hooks with strict redaction

[PatrickKish1]

Summary

• Adds opt-in SDK diagnostics (src/diagnostics/) for configuration, network, transaction lifecycle, wallet capability, and vault readiness.
• Lifecycle hooks are off by default (enableDiagnostics / setDiagnosticsHooks); emits are no-ops until enabled.
• Strict redaction via deny-listed keys + string scrubbing so secret keys, mnemonics, signed XDR, and related material never reach hooks or reports.
• Soft instrumentation in config, wallet, transactions, submit/retry, and vault readiness paths without changing existing public call signatures.
• Documents safe support workflows in docs/diagnostics.md (linked from README, support policy, architecture, and logging docs).

Closes #276

Test plan

• npm run test -- tests/diagnostics.test.ts tests/exports.test.ts (18 passed)
• npm run lint (tsc --noEmit)
• npm run check:circular
• Spot-check: enable hooks → createWallet() event has publicKey / hasSecretKey and no raw secretKey
• Spot-check: buildDiagnosticsReport({ network: 'testnet' }) JSON has no S… secrets