[AGENT] Prevent secret values in migration reports

[austenstone]

Which migration agent does this relate to?

• Jenkins Migrator
• Azure DevOps Migrator
• CircleCI Migrator
• GitLab Migrator
• Travis CI Migrator
• Bamboo Migrator
• Bitbucket Migrator
• Drone CI Migrator
• Reusable Workflow Builder
• New platform (please specify)

Is this a bug or an improvement?

• Bug - Agent produces incorrect output
• Improvement - Agent could handle this better

Describe the issue or improvement
A field migration generated .github/ci-archive/MIGRATION-README.md with credential values rather than secret names/references. Repository secret scanning then blocked or removed the generated report, so the documented phase could not complete without weakening security controls.

The shared migration instructions already say to document required secrets while never exposing values, but that invariant is not reliably enforced in generated reports.

Expected behavior:

• Record only secret and variable names, intended scopes, and ${{ secrets.NAME }} / ${{ vars.NAME }} references.
• Redact likely credential values before writing the report or PR body.
• Fail safely with a clear warning if sensitive values are detected in proposed output.
• Never recommend disabling secret scanning or push protection.
• Advise rotation when a value may already have been exposed.

Source CI/CD configuration (if applicable)

# Omitted. The source configuration contains customer-specific credential references.

Expected GitHub Actions output

env:
  SERVICE_TOKEN: ${{ secrets.SERVICE_TOKEN }}

The migration report should list SERVICE_TOKEN as a required repository or organization secret without including its value.

Actual output (if bug)

# Omitted. The generated report contained live credential values.

Additional context
This was observed in a live Jenkins migration using the documented review-output phase. The report path is mandatory, so secret-safe report generation needs to be a shared migration-core invariant rather than a platform-specific suggestion.