feat(config): redact secret-looking fields in GlobalConfig dumps

[leshy]

What

GlobalConfig.model_dump() and repr() now redact values of fields whose name looks secret — contains _secret or token, or ends in _key — replacing non-None values with ***.

This keeps secrets out of dimos show-config output and any place a config is logged/repr'd. Matching is by field-name pattern, so future secret fields (or env-injected extras) are masked automatically. False positives (e.g. tokenizer) are acceptable — over-censoring is the safe direction.

How to test

python - <<'PY'
from dimos.core.global_config import GlobalConfig

class C(GlobalConfig):
    api_key: str = "AKIA-secret"
    access_token: str = "tok_abc"
    client_secret: str = "shh"

c = C()
d = c.model_dump()
assert d["api_key"] == d["access_token"] == d["client_secret"] == "***"
assert "AKIA" not in repr(c) and "tok_abc" not in repr(c)
print("ok")
PY

Also: dimos show-config shows *** for any secret-named field; None and non-secret fields are unchanged.

Existing dimos/core/test_global_config.py passes; mypy dimos/core/global_config.py clean.

[codecov]

Codecov Report

❌ Patch coverage is 70.00000% with 3 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
dimos/core/global_config.py	70.00%	3 Missing ⚠️

Flag	Coverage Δ
OS-ubuntu-24.04-arm	63.85% <70.00%> (+<0.01%)	⬆️
OS-ubuntu-latest	64.70% <70.00%> (+<0.01%)	⬆️
Py-3.10	64.69% <70.00%> (+<0.01%)	⬆️
Py-3.11	64.69% <70.00%> (+<0.01%)	⬆️
Py-3.12	64.69% <70.00%> (+<0.01%)	⬆️
Py-3.13	64.69% <70.00%> (+<0.01%)	⬆️
Py-3.14	64.70% <70.00%> (-0.01%)	⬇️
Py-3.14t	64.69% <70.00%> (+<0.01%)	⬆️
SelfHosted-Large	30.39% <70.00%> (?)
SelfHosted-Linux	38.29% <70.00%> (+<0.01%)	⬆️
SelfHosted-macOS	37.00% <70.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
dimos/core/global_config.py	79.48% <70.00%> (-1.40%)	⬇️

... and 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.