The run bearer minted for a run must reach the redaction registry
before any code can use it, so a later read of run or issue text can
mask it. Add mintAndRegisterRunBearer(), the only allowed caller of
createLocalAgentJwt. It mints, then registers the token with the run
secret redaction registry before returning it. A registration failure
propagates and returns no token, so the caller aborts before it
injects a bearer into an adapter or a tool call.
Route all three mint sites through the wrapper: the legacy adapter
dispatch path and the two native-runtime tool paths (create_project
and call_api). A source-scanning test pins createLocalAgentJwt to have
no caller outside the wrapper and the unit tests.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
