feat: harden shared platform contracts

src/govoplan_core/security/redaction.py

@@ -30,18 +30,21 @@ def redact_secret_values(value: object, *, placeholder: str = "<redacted>") -> o
         return result
     if isinstance(value, list):
         return [redact_secret_values(item, placeholder=placeholder) for item in value]
+    if isinstance(value, tuple):
+        return tuple(redact_secret_values(item, placeholder=placeholder) for item in value)
     return value
 
 
 def contains_plain_secret(value: object) -> bool:
-    if not isinstance(value, Mapping):
-        return False
-    for key, item in value.items():
-        normalized_key = str(key).strip().casefold().replace("-", "_")
-        if normalized_key in {"credential_ref", "secret_ref", "secret_reference"}:
-            continue
-        if is_sensitive_key(key) and item not in (None, "", {"secret_ref": ""}):  # nosec B105 - empty redaction sentinels.
-            return True
-        if isinstance(item, Mapping) and contains_plain_secret(item):
-            return True
+    if isinstance(value, Mapping):
+        for key, item in value.items():
+            normalized_key = str(key).strip().casefold().replace("-", "_")
+            if normalized_key in {"credential_ref", "secret_ref", "secret_reference"}:
+                continue
+            if is_sensitive_key(key) and item not in (None, "", {"secret_ref": ""}):  # nosec B105 - empty redaction sentinels.
+                return True
+            if contains_plain_secret(item):
+                return True
+    elif isinstance(value, (list, tuple)):
+        return any(contains_plain_secret(item) for item in value)
     return False