Adds JSON output for the check command.

Scope:

• add --format console|json to check;
• keep console output as default;
• emit parseable JSON for ok, empty and error outcomes;
• preserve exit codes 0, 1 and 2;
• redact secret-like repository values in JSON output;
• add CLI tests for JSON output and redaction.

Validation:

• ./scripts/check.sh passed with 30 tests;
• console output verified;
• JSON ok output parsed with python -m json.tool;
• JSON empty output returns exit 1;
• JSON error output returns exit 2;
• secret-like path values are redacted;
• no raw secret-like literals in changed files.