privacy: redact AWS keys inside path or URL segments and URL-safe or unpadded Basic credentials #1082

Deferred by the engineering-review implementation loop from #1077 (issue #1026).

Problem

Two redaction gaps the #1077 reviewer measured, both pre-existing or non-standard and therefore left out of that PR:

1. An AWS secret access key inside a /-delimited path or URL segment (path/<key>, s3://bucket/<key>/obj, https://h/<key>?a=1) is never redacted, because the unlabeled AWS pattern's lookbehind (?<![A-Za-z0-9/+]) excludes a key preceded by /. Unchanged since before fix(checks): publish secret and injection findings, widen redaction #1077.
2. Unlabeled Basic tokens in URL-safe base64, or with the = padding removed, are not detected or redacted. Both are non-standard for RFC 7617, and the labeled Authorization: Basic … forms are redacted by the label pattern, so exposure needs an unlabeled, non-standard token.

Evidence

• src/agents_shipgate/core/privacy.py (AWS lookbehind; _is_basic_credential base64 decoding), as of PR fix(checks): publish secret and injection findings, widen redaction #1077 head df92fb5.
• Reviewer probe on fix(checks): publish secret and injection findings, widen redaction #1077 cycle 2: the three path/URL shapes above kept the key verbatim in every output; URL-safe and unpadded Basic tokens were kept verbatim.

Proposed fix

(1) Allow / before the AWS shape when the segment is exactly 40 characters of the AWS alphabet and does not read as words (reuse the #1077 words exemption), keeping relative paths such as Sources/PaymentKit/Handlers/RefundTools2 intact. (2) Decode URL-safe base64 and re-pad before the user:password check. Fixtures for all five shapes in the leak test.

Acceptance criteria

• A key inside a path or URL segment is redacted in every output; a normal path is not touched.
• URL-safe and unpadded Basic credentials are redacted; the clean-sample verdict test still passes.

Source

Engineering review 2026-10-12 follow-up (PR #1077 review cycle 2). Related: #1079. Tracked in #1060.