Harden CLI lane filtering and diagnostics redaction

internal/core/diagnostics/run_dir.go

@@ -42,6 +42,10 @@ type RetentionDecisionInput struct {
 	HasWarnings   bool
 }
 
+type RedactedEffectiveConfigPayload interface {
+	RedactedDiagnosticsPayload() any
+}
+
 // InvocationMetadata captures non-secret invocation details for diagnostics.
 type InvocationMetadata struct {
 	Operation      string    `json:"operation"`
@@ -134,8 +138,11 @@ func (r *RunDirectory) WriteInvocationMetadata(metadata InvocationMetadata) erro
 	return r.WriteJSONArtifact(ArtifactInvocationMetadata, metadata)
 }
 
-func (r *RunDirectory) WriteRedactedEffectiveConfig(payload any) error {
-	return r.WriteJSONArtifact(ArtifactEffectiveConfig, payload)
+func (r *RunDirectory) WriteRedactedEffectiveConfig(payload RedactedEffectiveConfigPayload) error {
+	if payload == nil {
+		return fmt.Errorf("redacted effective config payload must not be nil")
+	}
+	return r.WriteJSONArtifact(ArtifactEffectiveConfig, payload.RedactedDiagnosticsPayload())
 }
 
 func (r *RunDirectory) WriteResolvedPipeline(payload any) error {