Function redact_inline_secret 

pub fn redact_inline_secret(value: &str) -> String

The redaction placeholder for an INLINE secret value (DW-045): ${redacted:sha256:<first 8 hex of sha256>}. The short prefix lets an operator compare which key a generation carries without ever seeing the key; the placeholder itself is unresolvable by design, so echoing it back through a config-publishing surface is rejected fail-closed instead of installing placeholder bytes as a live key. Reference-shaped values are returned UNCHANGED (an env-var name or file path is not secret bytes — the config file already carries it).