Record every harness run in ai_runs with redaction and purge

harness.Run now writes one ai_runs row per run that reaches the provider,
covering the repair turn: skill, version, provider, model, temperature,
status (ok, repaired, bad_output, provider_error), latency, summed token
counts when reported, error text and the per-turn request and response
bodies. Every stored string is redacted first: the decrypted API key,
Authorization and API-key header values, Google Chat webhook URLs and
URLs with key-like query or fragment parameters or user info. JSON is
decoded and its strings redacted, so escapes cannot hide a credential.
A row that cannot be written fails the run.

Purge deletes rows created before a cutoff (RunRetention is 30 days),
clearing suggestion_batches and week_plans references in the same
transaction.

Migration 0006 rebuilds ai_runs with the new status CHECK and a
created_at index; a pre-harness running or error row stops it.

Maestro task 53e382d8-1db3-4555-a31d-e44cf55cc98d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ai/harness/prompt_test.go

@@ -117,7 +117,9 @@ func TestRunSendsLayeredPrompt(t *testing.T) {
 	var f llm.Fake
 	f.QueueGenerate(reply(`{"echo":"taco"}`))
 	in := echoInput{Word: "Taco", Context: tacoContext}
-	if _, err := Run(context.Background(), Config{Provider: &f, Persona: persona}, echoSkill{}, in); err != nil {
+	cfg := testConfig(t, &f)
+	cfg.Persona = persona
+	if _, err := Run(context.Background(), cfg, echoSkill{}, in); err != nil {
 		t.Fatal(err)
 	}
 	req := assertCalls(t, &f, 1)[0]