security: extend credential redaction to mysql -p<password> and PG* env-var idioms

Start in packages/opencode/src/session/compaction.ts and read how redactLedgerDetail and maskString use the existing credential-flag catalog, especially the #1246-style patterns. Find the existing regression tests for credential redaction and add cases for mysql -psecret, mysqldump -uroot -psecret, and PGPASSWORD=secret psql. Done means those idioms are masked without regressing the existing redaction cases.

Summary

#1246 closed a specific credential leak in ledger text: curl -u <user> <password> (space-separated) surviving redactLedgerDetail/maskString and getting persisted into a model prompt across session compaction. The fix is correct and well-tested for that exact idiom, but scoped narrowly to USER_FLAG_RE (curl-specific -u/--user) plus generic name=value / --flag=value / colon-shaped patterns.

Two sibling credential idioms in the same risk class are not caught by the current catalog in packages/opencode/src/session/compaction.ts:

1. MySQL client unseparated flag+value: mysql -psecret / mysqldump -uroot -psecret — no =, no space, no colon between flag and value. Neither USER_FLAG_RE nor the generic patterns match this shape.
2. Env-var-assigned credentials with no separator character before the sensitive name: PGPASSWORD=secret psql ... is not flagged as sensitive because SENSITIVE_NAME's boundary requirement ((?:^|[_-])password(?:$|[_-])) requires a _/- immediately before "password" — PGPASSWORD has neither.

Neither is new in this release; #1246 just closed one specific case, and its commit message framed it as closing "a curl -u credential leak" rather than the broader class.

Proposed fix

Sweep the full redactLedgerDetail/maskString credential-flag catalog for common CLI credential idioms (mysql, psql/PG* env vars, and any other unseparated -X<value> or unconventional env-var-name patterns) and extend the regex catalog + add regression tests per idiom, following the same pattern as the #1246 fix.

Provenance

Found during the v0.11.0 stable release's Chaos Gremlin (privacy/compliance) persona review, verified by reading packages/opencode/src/session/compaction.ts.