security: remediate CodeQL logging and ReDoS alerts

[KIM3310]

Summary

• replace the XML-root repair regex with deterministic bounded parsing
• emit only fixed credential status tokens from Datadog plan/validate/sync output
• use fixed configuration labels instead of environment-variable identifiers in experiment failure logs
• add adversarial, credential-sentinel, and missing-configuration regressions

CodeQL alerts addressed

• dependabot:(deps): bump the github-actions group with 4 updates #1–dependabot:(deps): bump the npm-all-updates group across 1 directory with 11 updates #4 clear-text logging diagnostics
• dependabot:(deps): bump the npm-all-updates group across 1 directory with 13 updates #5 js/polynomial-redos

Validation

• pnpm verify: 190 files / 1,731 tests, check, typecheck, and build
• coverage: 83.00% statements
• 13 Python tests and benchmark command
• repository-surface/health, YAML, gitleaks, and diff checks