fix(suggestions): redact standalone Cookie headers

[outlier27-cell]

Problem

Closes #603.

When opt-in suggestions serialize a standalone unquoted multi-cookie header, the general cookie= matcher redacts only the first value. On current main before this change:

Cookie: session=syntheticAlpha; sid=syntheticBeta
ordinary: visible

became Cookie: [REDACTED]; sid=syntheticBeta; the remaining synthetic value could therefore enter the suggestion-model transcript.

Value

Cookie header values should not be supplied to the suggestion model. The fix keeps adjacent ordinary transcript text available and does not claim general shell parsing or universal secret detection.

Approach

Before generic key/value rules, apply a case-insensitive, line-bounded replacement to standalone Cookie: header lines. The pattern retains optional indentation and the header label, replaces only that line's value, and cannot consume a following line. Add the public serializeRunTranscript regression for two values and a following ordinary line.

Validation

• Red: the new focused regression failed on 43cd2e94 with sid=syntheticBeta preserved.
• Green: node --experimental-strip-types --test tests/extensions/suggestions/transcript.test.ts — 39/39 passed.
• node --experimental-strip-types --test tests/extensions/suggestions/*.test.ts — 72/72 passed.
• bun run check — passed (config/docs/discipline contracts, web build, format, lint, TypeScript; existing Vite chunk-size warning only).
• bun run test — started and reached the existing real-Pi post-edit timeout cluster (8 failures) before this PR touches those files; it remains running at PR creation time. This is not claimed as a full-suite pass.

All test and reproduction values are synthetic; no live suggestion-model request was made.

Impact

• User-visible behavior: no new command, configuration, or UI.
• Model-visible context: all values on standalone Cookie header lines are redacted before suggestion prompts.
• Runtime/lifecycle and persisted data: none.
• Compatibility/risk: intentionally narrow line-based rule; shell-embedded headers retain the existing best-effort token behavior and quoted credential coverage from fix(suggestions): redact complete quoted credential values #594 is unchanged.

[tt-a1i]

[P2] Keep the Cookie replacement on one line (extensions/suggestions/src/transcript.ts:74). The \s* after Cookie: matches line breaks. I reproduced Cookie:\nordinary: visible becoming only Cookie: [REDACTED]; the ordinary next line is lost, contrary to the stated transcript-preservation contract. The same happens with CRLF. Restrict the whitespace to [ \t]* and add empty-header LF/CRLF regressions.

[outlier27-cell]

Updated head 5d09cb2 per review: standalone Cookie redaction now restricts post-header whitespace to spaces/tabs, so an empty LF or CRLF header cannot consume the following line. Added both LF and CRLF regressions. Local focused transcript tests: 41/41; bun run check: passed; git diff --check: passed. Exact-head GitHub CI is green.

[tt-a1i]

Reviewed updated head 5d09cb2: standalone Cookie redaction now stays on its own line for both LF and CRLF, preserves following ordinary text, and exact-head CI is green.