fix: redact identity secrets through a public hook and mask issued agm_ tokens

Identity gains a redact field that the executor honours, so the OAuth
resolver no longer needs an executor subclass overriding private
internals. Opaque agm_ tokens issued by our authorization server are now
masked by the secret patterns wherever they appear in content.

tests/test_security.py

@@ -9,6 +9,19 @@ def test_detect_secrets_api_key_pattern() -> None:
     assert findings
 
 
+def test_issued_oauth_tokens_are_masked() -> None:
+    """Our own ``agm_`` OAuth tokens are masked wherever they show up in content."""
+    issued = "agm_" + "Ab3_-x" * 7 + "Z"  # the shape of agm_ + token_urlsafe(32)
+    text = f"pasted by mistake: {issued}."
+
+    findings = detect_secrets(text)
+    masked = sanitize_data({"body": text})
+
+    assert [finding.secret_type for finding in findings] == ["aegis_oauth_token"]
+    assert issued not in masked["body"] and masked["body"].endswith(".")
+    assert detect_secrets("agm_short") == []
+
+
 def test_sanitize_data_mask_mode() -> None:
     """Mask mode should preserve structure while redacting values."""
     payload = {"content": "api_key=AKIA1234567890ABCDEF"}