Add Operation Plane CLI surface: fixture validation/replay/scaffolding and diagnostics redaction

[Copilot]

This PR adds the first-class Operation Plane tooling surface in sourceos-devtools so developers/operators can validate and scaffold Workspace Operation fixtures locally, while keeping devtools as a validation/scaffolding layer (not runtime or policy authority). It also introduces a redaction CLI for diagnostic exports covering the sensitive classes called out in the issue.

• Operation CLI command group (sourceos operation)

  • Added operation conformance as a wrapper over the existing conformance runner.
  • Added operation validate-fixture for single-fixture structural + state-machine consistency checks.
  • Added operation replay-fixture to generate local replay fixture starters.
  • Added operation scaffold-adapter to generate starter adapter skeletons for:
    • terminal command
    • browser capture
    • local agent execution

• Diagnostics CLI command group (sourceos diagnostics)

  • Added diagnostics redact to redact sensitive fields in diagnostic exports:
    • cookies
    • bearer/OAuth tokens
    • API keys and secrets
    • sensitive IDs
    • model prompts
    • policy-marked snippets

• Command surface + docs

  • Added bin/sourceos alias entrypoint and wired routing in bin/sourceosctl.
  • Updated README.md and docs/operation-conformance-runner.md with new command usage from ~/dev/<repo> layout.

• Fixtures + targeted coverage

  • Added sample Workspace Operation fixtures for terminal/browser/local-agent surfaces.
  • Added focused tests for operation and diagnostics command behavior, including JSON-preserving redaction behavior.

Example usage:

python3 bin/sourceos operation validate-fixture \
  tests/fixtures/workspace-operation/minimal-operation.json \
  --structural-only

python3 bin/sourceos operation scaffold-adapter ./tmp-adapter

python3 bin/sourceos diagnostics redact \
  ./diagnostic.log \
  --output ./diagnostic.redacted.log