fix(runtime): bound secret masking scan work

[ohdearquant]

Summary

• bound cumulative suffix work performed while collecting secret spans
• redact the remaining tail fail-closed when dense credential input exhausts the work budget
• document the behavior and add a deterministic 1 MiB work-count regression

Verification

• cargo fmt --all -- --check
• cargo clippy -p khive-runtime --all-targets -- -D warnings
• cargo test -p khive-runtime --quiet
• cargo test -p khive-runtime mask_secrets_bounds_suffix_scan_work_on_dense_credentials -- --nocapture

Fixes #2054