fix(logging): redact exception locals

[ThaddeusJiang]

Summary

• disable Loguru local-variable diagnostics for Bub's stderr sink
• apply the same policy to the optional Logfire sink
• add a regression test requiring every Bub-owned sink to set diagnose=False

This preserves traceback/error reporting while preventing exception logs from rendering local secrets such as provider API keys.

Closes #292

Verification

• make check
• make test (307 passed)
• git diff --check

[dagebot]

Review: ✅ Looks good, approve

This is a solid security fix for #292. Loguru's default diagnose=True renders local variables in exception traces, which could leak provider API keys.

What I like

• Precise change — diagnose=False on both sinks (stderr + Logfire), preserving traceback/error info while hiding local variable values.
• Real issue — The security risk is genuine: exception logs could expose sensitive config like API keys.
• Good regression test — Monkeypatches logger.add and asserts every Bub-owned sink explicitly disables diagnostics. Prevents future sinks from forgetting.
• CI all green — quality, tests-and-type-check (3.12/3.13/3.14), check-docs all pass.

Minor note

The test monkeypatches the global logger.remove/logger.add. If future tests interact with loguru they might conflict, but no issue currently.

Conclusion: Direct merge. Simple, focused, with proper test coverage.