fix(session-flow): bound the pre-existing slow redaction regexes in observer and save_point #5951

Problem

Several redaction regexes in session-flow backtrack super-linearly on adversarial input. Pre-existing on main; measured on branch feat/github-platform-features.

Evidence

• running-retro observer _REDACTIONS email rule (plugins/session-flow/skills/running-retro/scripts/observer.py): 11.7 s on 'ghs_1_-'*50000, 6.7 s on 'ghs_1_eyJa.'*30000, 6.1 s on 'ghs_1_eyJ-'*30000.
• Python JWT rule: 7.5 s on '-eyJ'*75000.
• URL connection-string rule: ~15 s on 'a.'*150000.
• The JWT and URL rules exist in both plugins/session-flow/scripts/save_point.py and plugins/session-flow/skills/running-retro/scripts/observer.py.

Suggested fix

Bound segment lengths in each pattern, or redact only a bounded prefix of each candidate. Add timing tests per rule, following how #5935 did it for the ghs_ rule.

Found while working on #5935.