feat(learn): sanitize sensitive data in --write-rules output

Problem

rtk learn --write-rules outputs raw command pairs into .claude/rules/cli-corrections.md. These commands often contain sensitive infrastructure identifiers that get auto-loaded into every Claude Code session if the file is committed:

• AWS resource IDs (vpc-*, sg-*, subnet-*, vpce-*, i-*)
• AWS account IDs (12-digit numbers in ARN contexts)
• Route53 hosted zone IDs (Z0...)
• Absolute paths containing usernames (/Users/john/...)
• Internal repository URLs with org names

Reproduction

rtk learn --write-rules --since 60
cat .claude/rules/cli-corrections.md
# File contains raw infrastructure IDs, account numbers, file paths with usernames

Impact

The generated rules file is intended to be committed to a repo and auto-loaded by Claude Code. Sensitive data in this file:

• Leaks infrastructure details into context windows
• Creates a security risk if the repo is public or shared
• Requires manual review/editing before every commit, defeating the automation purpose

Proposed Solution

Add regex-based sanitization to report.rs that redacts sensitive patterns before writing:

Sanitization should be on by default for --write-rules and available as --sanitize flag for report mode. A --no-sanitize flag would preserve raw output for debugging.

Additional Improvements (same scope)

1. Bump --min-occurrences default from 1 to 2 — At min-occurrences=1, nearly every correction is a one-off context-dependent retry (e.g., 38 rules from 39 corrections, but only 1 recurs). Default of 2 surfaces genuinely reusable patterns.

2. Add a noise warning — When >80% of corrections are single-occurrence, print a hint: "Most corrections are single-occurrence. Use --min-occurrences 2 to filter to recurring patterns."

Happy to submit a PR for this. Would target develop per contribution guidelines.

Start in report.rs and trace the CLI entry points for --write-rules and report mode. Review how --min-occurrences is parsed and applied, then identify existing tests for generated rules or reports. Done means sensitive values are sanitized with the specified flag behavior, recurring-pattern defaults and warnings are covered, and the relevant tests pass.