fix(packaged): restore bare auth= scrubbing dropped in the Authorization fix

Review (nettee): removing authorization/auth from the key=value branch to fix
the Authorization-header leak also dropped generic 'auth=abc' / 'auth: abc'
scrubbing. Re-add 'auth' to the key=value alternation — it can't misfire on
'Authorization'/'author' because a [=:] separator must immediately follow the
word, and the Authorization header itself is still handled by the dedicated
whole-value rule.

Author: lefarcen

apps/packaged/src/startup-telemetry.ts

@@ -195,9 +195,12 @@ export function scrubSecrets(value: string): string {
     // scheme word ("Bearer"/"Basic") and leave the credential
     // ("Authorization: Bearer abc" -> "<redacted> abc"), so handle it first.
     .replace(/(\bAuthorization\s*[:=]\s*)\S[^\r\n]*/gi, "$1<redacted>")
-    // `key = value` / `key: value` secrets (password, token, secret, api_key, …).
+    // `key = value` / `key: value` secrets (password, token, secret, api_key,
+    // auth, …). `auth` is kept here for bare `auth=…` fields; it can't misfire on
+    // "Authorization"/"author" because a `[=:]` separator must immediately follow
+    // the matched word (the Authorization *header* is handled by the rule above).
     .replace(
-      /\b(pass(?:word|wd)?|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)(\s*[=:]\s*)("?)[^\s"'&]+\3/gi,
+      /\b(pass(?:word|wd)?|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret|auth)(\s*[=:]\s*)("?)[^\s"'&]+\3/gi,
       "$1$2<redacted>",
     )
     // Inline Bearer/Basic token values not under an Authorization header.

apps/packaged/tests/startup-telemetry.test.ts

@@ -192,6 +192,14 @@ describe('scrubSecrets', () => {
     expect(scrubSecrets('using key sk-ant-api03-ABC123DEF456GHI789 now')).not.toContain('ABC123DEF456');
   });
 
+  it('redacts a bare auth=… / auth: … field without misfiring on author or the header', () => {
+    expect(scrubSecrets('auth=abc12345')).toBe('auth=<redacted>');
+    expect(scrubSecrets('auth: abc12345')).toBe('auth: <redacted>');
+    // A `[=:]` must follow the word, so "author"/"Authorization" don't misfire here.
+    expect(scrubSecrets('author=jane')).toBe('author=jane');
+    expect(scrubSecrets('Authorization: Bearer abc12345')).toBe('Authorization: <redacted>');
+  });
+
   it('redacts key=value secrets and bare emails', () => {
     expect(scrubSecrets('password=hunter2 token: abc12345')).toBe('password=<redacted> token: <redacted>');
     expect(scrubSecrets('login failed for user ontf116@gmail.com')).toBe(