[AGENT] Prevent secret values in migration reports

**Which migration agent does this relate to?**
- [x] Jenkins Migrator
- [ ] Azure DevOps Migrator
- [ ] CircleCI Migrator
- [ ] GitLab Migrator
- [ ] Travis CI Migrator
- [ ] Bamboo Migrator
- [ ] Bitbucket Migrator
- [ ] Drone CI Migrator
- [ ] Reusable Workflow Builder
- [ ] New platform (please specify)

**Is this a bug or an improvement?**
- [x] Bug - Agent produces incorrect output
- [ ] Improvement - Agent could handle this better

**Describe the issue or improvement**
A field migration generated `.github/ci-archive/MIGRATION-README.md` with credential values rather than secret names/references. Repository secret scanning then blocked or removed the generated report, so the documented phase could not complete without weakening security controls.

The shared migration instructions already say to document required secrets while never exposing values, but that invariant is not reliably enforced in generated reports.

Expected behavior:
- Record only secret and variable names, intended scopes, and `${{ secrets.NAME }}` / `${{ vars.NAME }}` references.
- Redact likely credential values before writing the report or PR body.
- Fail safely with a clear warning if sensitive values are detected in proposed output.
- Never recommend disabling secret scanning or push protection.
- Advise rotation when a value may already have been exposed.

**Source CI/CD configuration (if applicable)**
```yaml
# Omitted. The source configuration contains customer-specific credential references.
```

**Expected GitHub Actions output**
```yaml
env:
SERVICE_TOKEN: ${{ secrets.SERVICE_TOKEN }}
```

The migration report should list `SERVICE_TOKEN` as a required repository or organization secret without including its value.

**Actual output (if bug)**
```yaml
# Omitted. The generated report contained live credential values.
```

**Additional context**
This was observed in a live Jenkins migration using the documented review-output phase. The report path is mandatory, so secret-safe report generation needs to be a shared migration-core invariant rather than a platform-specific suggestion.

Start by reading the shared migration instructions and tracing the migration-core path used by the Jenkins Migrator's review-output phase, including generation of .github/ci-archive/MIGRATION-README.md and the PR body. Verify that reports list names, scopes, and references without values, warn clearly on sensitive output, preserve secret scanning and push protection guidance, and advise rotation when exposure is possible.

Written by the indexing model from the issue text.