Harden OTLP credential redaction and eval sandbox isolation (#68811)

* Prevent OTLP credentials leaking through eval logs and artifacts

Derive encoded, decoded and JSON-escaped OTLP credentials for runner masks, artifact and summary redaction, and eval verification. Exclude aggregated OTLP headers from agent sandboxes and regenerate compiled workflows.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fix isolated OTLP redaction dependency deployment

Separate dependency-free header parsing and credential collection from runner masking and telemetry export. Deploy the shared helper with both isolated MCP runtimes and retain dependency closure and credential redaction checks.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Redact OTLP passwords in numeric scalar artifact records

Match numeric scalar tokens before number normalization and emit masked values as JSON strings. Cover digit-only Basic-auth passwords, mixed logs, and unchanged numeric records.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Address OTLP masking review feedback

Remove the unused authorization masking wrapper and exercise the real credential primitives directly. Add collector edge-case coverage and replace the inaccurate lingering-secret count with an explicit fail-closed diagnostic.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Redact nested numeric credentials using original JSON tokens

Mask numeric tokens at every JSON depth before numeric normalization can lose credential digits. Preserve unmatched numeric representations and add nested object, array, JSONL, artifact, summary, and eval verification regressions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: pelikhan