Settings CLI leaks nested secret values

[chubes4]

Problem

wp datamachine settings get github_credential_profiles --format=json exposes nested PAT values even without --reveal. wp datamachine settings set github_credential_profiles ... also prints the complete old and new values, including credentials.

This was observed while repairing an expired Data Machine Code GitHub profile. Both the invalid PAT and its valid replacement were emitted to command output.

Root cause shape

Secret detection/redaction appears to classify top-level setting keys or scalar values, but does not recursively redact secret-like fields such as pat, token, private_key, or passwords inside arrays/objects. The setter success message bypasses redaction entirely.

Acceptance criteria

• settings get recursively redacts nested secret-like fields unless --reveal is explicitly supplied.
• settings set never echoes secret-bearing old or new values.
• JSON output remains structurally useful while replacing secret values with a stable redaction marker.
• Regression coverage includes github_credential_profiles-shaped nested arrays.
• Existing non-secret settings output remains unchanged.

Security handling

The exposed credentials are being rotated separately and are intentionally omitted from this issue.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.6 Sol)
• Used for: Reproduced the leak, traced its operational impact, and drafted this tracker with Chris.