fix: prevent publish abort on auto-generated logger-credential named values

[EMaher]

Summary

apiops publish aborts with a false-positive secret-redaction error when the source APIM has loggers (Application Insights / Event Hub).

APIM auto-generates secret named values named Logger-Credentials--<hex> (24-char hex IDs) to hold logger credentials. These are redacted to *** REDACTED *** on extract. The publish pre-flight redaction guard scanned them and aborted before issuing a single PUT:

Publish aborted: 2 artifact(s) still contain the redaction marker '*** REDACTED ***'.
  - namedValues/6a46928afa1f751d044d805e (properties.value)
  - namedValues/6a46928afa1f751d044d8063 (properties.value)

However, the publisher already skips these auto-generated named values in splitNamedValues() — APIM recreates them when the referencing logger is published — unless the user supplies an explicit override. The guard did not apply the same filter, so it flagged redaction markers in artifacts that are never sent to APIM.

Fix

• Make the redaction guard mirror the publisher: in scanNamedValue(), skip auto-generated named values that have no explicit override. This guarantees the invariant the guard skips a named value iff publish skips it — no path exists where a placeholder secret is skipped by the guard but still PUT to APIM.
• Extract hasNamedValueOverride() into override-merger.ts as the single source of truth shared by both call sites (also avoids a publish-service ↔ secret-redaction-guard circular import).

Testing

• Added 2 unit tests to secret-redaction-guard.test.ts:
  • auto-generated named value without an override is skipped (asserts the resource is never read)
  • auto-generated named value with an override is still scanned (marker still caught)
• Existing secret / non-secret / KeyVault-backed / policy cases remain green.
• Full unit suite passes; ESLint clean.
• Validated end-to-end against a live APIM roundtrip (all-resource-types integration test): publish now clears the pre-flight guard on the Logger-Credentials--* named values.

Notes

• Cherry-picked from the copilot/delete-unmatched-parameter-fix branch (originally commit f0894aa) so this important fix can land independently and be approved ASAP.
• Reviewed against the constitution (§VI Testability, §VIII Secret Safety) — no blockers.

Related Issue(s)

None.

[EMaher]

@copilot - Revert the change to CHANGELOG.md

[Copilot]

@copilot - Revert the change to CHANGELOG.md

Done in c29bcb4 — CHANGELOG.md has been reverted.