harden: add email/phone/path redaction patterns to scrub; gate name-redaction as anchored opt-in

[edheltzel]

Cross-reference: #182.

scrub() (hooks/lib/write-safety.ts) redacts distinctive secret shapes only. It currently has no email, phone, path, or name redaction.

Red-team split:

1. Add email / phone / path patterns. These are distinctively shaped, near-zero false-positive, and consistent with the existing invariant that over-redaction is a failure (write-safety.ts:50-53).
2. Gate name redaction as opt-in only: word-boundary + minimum-length anchored + owner-dictionary-scoped.

Do not market this as general personal-name redaction. Without NER, it will over-redact code identifiers when a short owner name appears inside terms such as Edit.

Acceptance: scrub() gains the high-confidence patterns by default; any owner-name redaction path is explicitly opt-in and scoped.