refactor(redact): trim review-talk in providers.go, document over-redaction

Shorten the provider-token file header to the durable technical content (the betterleaks composite-rule dependency and the publishable-key non-redaction rationale) and drop the issue-#1716 narrative and restated PR-review rationale.

Also document a known, accepted false-positive class: since the body charset includes underscore and the {20,} length check has no upper bound, long snake_case identifiers that merely start with a provider prefix get redacted even when they aren't secrets, including mid-word since the prefix is deliberately unanchored. Pin the tradeoff with a test so a future change doesn't "fix" it by reintroducing anchors.