* feat(secrets): let workspace secrets opt out of redaction
* fix(secrets): certify no sandbox exemptions once the registry is incomplete
* feat(secrets): carry visible secret values on the v2 list and document visibility
* fix(secrets): read visible values by own property so prototype-named secrets cannot poison the list