fix(desktop): route Rive diagnostics through the core secret redactor

## Problem

`apps/desktop/src/main/rive-cli.ts` maintains a private `redactRiveText` implementation alongside the authoritative `@maka/core/redaction` rules. The local copy only recognizes a small set of bearer, `sk-`, and key/value patterns, so newly supported credentials such as GitHub, Google, or Slack tokens can be emitted in Rive diagnostics and tool output.

## Scope

- Make the core redactor the single source of truth for Rive stdout/stderr tails, error envelopes, command display, and structured values.
- Keep the existing deep-value traversal and maximum-depth guard, and preserve the current Rive helper exports where callers use them.
- Keep the command protocol and result shape unchanged.

## Acceptance criteria

- Rive output and error projections never expose core-supported token forms or sensitive keyed values.
- Nested arrays/objects remain bounded by the existing depth policy.
- Existing Rive workflow tests pass, with regression coverage for at least one token form that the local implementation missed.

This is the Rive redaction slice of #1404.

Start with apps/desktop/src/main/rive-cli.ts and the authoritative @maka/core/redaction rules; trace how Rive stdout/stderr, errors, command display, and structured values are projected. Preserve the existing deep traversal, depth guard, helper exports, protocol, and result shape, then add regression coverage for a token form the local implementation missed and run the existing Rive workflow tests.

Written by the indexing model from the issue text.