#3712 fix(trace): keep SSH key fingerprints in redacted sessions

Chainloop Trace redacted the SHA256 fingerprint that git prints when it checks an SSH commit signature, for example in the output of git log --show-signature. The betterleaks generic-api-key rule matches it, so the session showed a redaction placeholder and the ai-config-no-secrets policy reported a secret. A fingerprint is a hash of a public key, not a credential.

This adds an allowlist to the redaction ruleset for an OpenSSH SHA256 fingerprint: SHA256: followed by exactly 43 base64 characters at the end of the match. A longer value after the same prefix, and other secrets in the same text, are still redacted.

AI disclosure: this change was produced with assistance from Claude Code.