Credential leaks: PackFetcher, PackAdder, and BootstrapFileError print raw source URLs #401

Summary

redactSourceForDisplay in BootstrapCommand (added in #397) sanitizes the bootstrap-specific diagnostics, but the shared and adjacent code paths still print raw URLs that may carry embedded credentials (https://user:token@host/...).

Sinks

1. BootstrapFileError.duplicateSource / .reservedScope — errorDescription interpolates the raw source; BootstrapCommand prints via error.localizedDescription, which bypasses redaction.
2. PackAdder.addGit info line — "Fetching pack from \(gitURL)..." at PackAdder.swift:64. Shared by mcs pack add and mcs bootstrap; both surfaces the raw URL.
3. PackAdder.resolveDuplicate warning — prints both existing.sourceURL and sourceURL in the "already registered from a different source" warning at PackAdder.swift:327. Replacing across sources can leak both URLs' credentials.
4. PackFetchError.cloneFailed — "Failed to clone '\(url)': \(stderr)". Even if the progress line is redacted, catch { output.error(error.localizedDescription) } at PackAdder.swift:70 still leaks the URL on failure. Git's stderr may also echo the URL.

Fix shape

Hoist redactSourceForDisplay from BootstrapCommand to a shared home (probably PackSource.swift or a new SourceRedaction.swift). Apply at:

• Every throw PackFetchError.*(url: …) construction OR at the errorDescription renderer inside PackFetchError.
• BootstrapFileError.errorDescription for the two source-carrying cases.
• Every PackAdder and PackFetcher output sink that names a source or URL.

Also sanitize git stderr before echoing it — a git clone https://token@host/… failure includes the token in stderr.

Test seams already exist (BootstrapSourceRedactionTests); extend to cover BootstrapFileError message rendering and the PackAdder/PackFetcher error paths (probably against a mocked shell).

Refs

• PR Add mcs bootstrap for declarative per-project setup #397, review round 4
• Copilot comments: BootstrapFile.swift:52, PackAdder.swift:64, PackAdder.swift:70, PackAdder.swift:327