fix(acceptance): keep safe fleet metadata clear of sensitive report fields

scripts/fleet-test-env-acceptance.mjs

@@ -573,18 +573,35 @@ export function fleetCostShares(trip, dispatchDetails) {
   return shares
 }
 
+export function fleetCostActorJournalData(value) {
+  const clean = redactEvidence(value)
+  function removeCredentials(item) {
+    if (Array.isArray(item)) return item.map(removeCredentials)
+    if (!item || typeof item !== 'object') return item
+    const result = {}, forbidden = /^(?:password|newPassword|temporaryPassword|accessToken|refreshToken|authorization)$/i
+    let removed = false
+    for (const [name, field] of Object.entries(item)) {
+      if (forbidden.test(name)) removed = true
+      else result[name] = removeCredentials(field)
+    }
+    if (removed) result.credentialFieldsRemoved = true
+    return result
+  }
+  return removeCredentials(clean)
+}
+
 export async function prepareFleetCostActors(context) {
   if (!context.marker || context.createdResources.fleetCostActors || typeof context.checkpoint !== 'function')
     throw Error('Cost actors require fresh current-run ownership and durable checkpoints')
   const proof = context.createdResources.fleetCostActors = { marker: context.marker, status: 'CREATING', actors: [], requests: [] }
   const base = '/api/platform/v1/iam', sessions = []
   async function request(method, path, body, token) {
-    const entry = { method, path, body: redactEvidence(body), status: 'SENDING' }
+    const entry = { method, path, body: fleetCostActorJournalData(body), status: 'SENDING' }
     proof.requests.push(entry); await context.checkpoint()
     try {
       const response = await context.request(method, path, body, token)
       Object.assign(entry, { status: 'RESPONDED', http: response?.http, code: response?.body?.code,
-        requestId: response?.requestId, traceId: response?.traceId, result: redactEvidence(response?.body?.data) })
+        requestId: response?.requestId, traceId: response?.traceId, result: fleetCostActorJournalData(response?.body?.data) })
       await context.checkpoint()
       if (!success(response) || !response.requestId || !response.traceId) throw Error(`Cost actor request failed: ${method} ${path}`)
       return response.body.data