fix(log): one physical record per log event; stop replaying SSH diagnostics

[skevetter]

Implements the logging record consistency handoff.

• `pkg/log`: text encoder wrapper escapes LF/CR/controls/Unicode separators so each event is one LF-terminated record; logfmt quotes CR/control chars.
• `pkg/secrets`: `WithLogEscapes` adds serialized variants of secrets so post-encode redaction still masks multiline/control secrets (extra observed variants beyond handoff, pinned by tests).
• `pkg/log`: `LogSummaryProvider`/`ErrorForLog` (2048-rune cap).
• `sshtunnel`: typed `agentCommandFailure`; `Error()` byte-identical to previous text, `LogSummary()` omits diagnostics.
• `pipebridge`: completion debug log uses `ErrorForLog`; no raw JSON replay.

Verification: `go test -race` on pkg/secrets, pkg/log, pkg/tunnel, pkg/devcontainer/sshtunnel pass; `./cmd/...` and clientimplementation pass; vet clean. Red tests verified failing with encoder/redaction wrap removed. golangci-lint not run locally (another instance was running); CI pending.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	0c45e07
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6acec20f89fb4f3b77d608a9

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	0c45e07
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6acec20f5eb2da787ac4b043

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}