fix: detect secret-only changes in redacted diffs

[rogerchappel]

Summary

• Compare unredacted normalized lines internally, then redact only the resulting report evidence so value-only secret changes remain visible.
• Add regression coverage for changed and unchanged synthetic secrets, including default Markdown and JSON CLI output.
• Clarify the default redaction semantics in the README.

Commits:

• 9f49d80 fix: detect redacted secret value changes
• c65574e docs: clarify secret-only diff behavior
• 7aef390 test: cover redacted cli secret diffs

Verification

• Tests or checks run: npm ci; npm test; npm run release:check; git diff --check
• Manual review completed: confirmed synthetic values are absent from rendered Markdown/JSON and all proposed commits use the required author and committer identity.

Risk Level

• Low
• Medium
• High

Notes: The public result schema is unchanged. Redacted comparisons now retain a private in-memory comparison representation long enough to distinguish value-only changes; report fields remain redacted.

Rollback Plan

• Revert the three commits in this PR to restore the previous compare behavior and documentation.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: