fix(runtime): report accurate hex secret matches

[ohdearquant]

Summary

• Limit surrounding entropy-trigger context to the candidate's current sentence while preserving single-newline credential assignments.
• Return the raw contributing hex span from per-run, normalized, and bridged hex detection so excerpts and redactions identify the matched candidate.
• Document the sentence-boundary and reconstructed-span behavior.

Verification

• RED: cargo test -p khive-runtime issue_2056 -- --nocapture — both regressions failed with verbat...8chars.
• GREEN: cargo test -p khive-runtime issue_2056 -- --nocapture — 2 passed, 0 failed.
• cargo fmt -p khive-runtime -- --check
• cargo clippy -p khive-runtime --all-targets -- -D warnings
• cargo test -p khive-runtime

Regression coverage:

• issue_2056_hex_bridge_masks_the_matched_candidate
• issue_2056_detector_name_does_not_trigger_across_sentence_boundary

Scope

Provider-prefix and inline credential-assignment policy are unchanged.

Fixes #2056