(agent): pre-egress PII/secret scrubbing for progress events and PR content

### Component

Agent (Python runtime)

### Describe the feature

Add a pre-egress data-loss-prevention (DLP) / PII scrubbing stage that scans and sanitizes any content the agent emits outside the isolated compute environment before it leaves the MicroVM. Two egress channels are in scope today:

1. **Progress events** written to `TaskEventsTable` from `agent/src/progress_writer.py` (consumed by `bgagent watch`).
2. **PR content** — titles, descriptions, and comments the agent generates when opening or iterating on pull requests.

The stage would apply a configurable policy per detected entity type — one of `BLOCK` (drop the message / fail closed), `REDACT` (mask the span), `HASH` (replace with a stable hash for correlation), or `PASS` — and emit an audit record for every non-`PASS` action.

### Use case

ABCA agents clone tenant repositories and operate autonomously on tenant data inside isolated environments. Every byte that crosses the isolation boundary — progress events surfaced to operators, and PR bodies pushed to GitHub — is a potential exfiltration path for secrets or PII that the agent encountered while working (API keys in a `.env`, customer data in fixtures, tokens in logs it summarizes). Today there is no systematic scrub on these egress paths; we rely on the agent not to repeat sensitive material. A deterministic, policy-driven gate on egress gives us defense-in-depth that does not depend on model behavior, and produces the audit trail operators need.

### Proposed solution

- Introduce a `dlp`/`egress_filter` module in `agent/src/` with a detector covering common high-signal entity types (cloud credentials/API keys, private keys, AWS access key IDs, emails, and other configurable patterns) plus an allow/deny policy table.
- Wire it as the single choke point in `progress_writer.py` so **all** events pass through it before `PutItem`, and at the PR-content assembly step in `pipeline.py`/`runner.py` before any GitHub write.
- Make policy per-entity-type and configurable via `config.py`; default to `REDACT` for PII and `BLOCK` for credentials/secrets (fail closed on the highest-risk classes).
- Emit a structured audit event (entity type, action taken, channel — never the raw value) for each redaction so operators can see what was scrubbed.
- Tests under `agent/tests/` (extend `test_progress_writer.py`, add `test_egress_filter.py`) with fixtures for each entity type and each policy outcome.

This keeps the contract change additive — the consumer side (`cli/src/commands/watch.ts`) sees already-sanitized events.

### Other information

- Complements the existing Cedar HITL gates and `policy.py` (this is data-plane sanitization, those are action-plane authorization).
- Relates to per-session IAM scoping (#209) — that bounds what the agent *can read*; this bounds what *leaves* once read.
- Consider false-positive calibration so legitimate code/identifiers aren't over-redacted in PR diffs; the PR-body path likely needs a narrower policy than the progress-event path.

### Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change