bip93: Redact artifact string rendering

[BenWestgate]

Stop default str/repr rendering from exposing Codex32 recovery text or payload symbols. Explicit .text export remains unchanged, and nested CorrectionCandidate reprs are redacted through the artifact repr.\n\n\n\nValidation: 862 pytest tests; mypy; Ruff check/format; 57 frozen differential-correction cases; nested/default-format leakage reproducer.

Fixes #22.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8831c8e40d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

crACK 18cd864

[BenWestgate]

Thanks @FractalEncrypt for confirming this finding!

[BenWestgate]

Security fix-verification refresh on current reviewability-v1 (cf1a599): fixed for the default-rendering disclosure finding. An exact archive reproducer confirms the serialized recovery text is absent from str(artifact), repr(artifact), and repr(CorrectionCandidate), while .text remains the explicit export path. The focused public-API regressions for Share and MasterSeed both pass. This verifies the merged remediation against the original accidental-disclosure path.

[BenWestgate]

Independent security-fix verification against #22, rechecked on the current reviewability-v1 tree:

• _Artifact.__str__() returns only <Type: redacted> and _Artifact.__repr__() returns Type(<redacted>); neither uses .text or payload symbols.
• Share/Secret documentation makes .text the explicit serialized-value path.
• tests/test_public_api.py asserts the complete recovery text is absent from both direct str/repr and nested CorrectionCandidate reprs, and separately checks MasterSeed repr does not expose payload symbols.
• The security model documents the residual boundary correctly: redaction reduces accidental logging/interpolation disclosure but does not make explicit .text export safe to expose.

The validated finding remains fixed on the current release branch; I found no regression in the rendering boundary.