fix: redact secret env values in stall diagnostics inspect output

docker inspect captures the container Env block, which for CI job
containers carries CI_GITEA_API_TOKEN and similar secrets — the diag
bundle must not become a secret artifact (OBL-INFRA-548 S02).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2

@@ -57,7 +57,11 @@ now_epoch=$(date +%s)
             echo "=== stall diagnostics for $cname ($cid), age ${age_min}m ==="
             echo "--- exec probe: TIMEOUT (>10s) ---"
             echo "--- docker inspect ---"
-            timeout 15 docker inspect "$cid" 2>/dev/null
+            # Implements: REQ-3 — full inspect, but redact the Env block:
+            # job containers carry CI tokens in env vars; the bundle must
+            # not become a secret-material artifact.
+            timeout 15 docker inspect "$cid" 2>/dev/null \
+                | sed -E 's/("[^"]*(TOKEN|PASSWORD|SECRET|KEY)[^=]*=)[^",]*/\1<redacted>/Ig'
             echo "--- docker top ---"
             timeout 15 docker top "$cid" 2>/dev/null
             echo "--- docker stats --no-stream ---"