Per-provider credential redactors shared by the bundled adapters.
Layer B helper. Each function replaces the credential shapes of ONE
provider with [REDACTED] in a provider-authored string (an error
message, an error code, a block reason) before it reaches an error
struct. The patterns are deliberately separate: a pattern borrowed from
a sibling provider matches nothing in the other provider's text, so it
would redact nothing without failing. Every adapter of a provider calls
that provider's function here instead of carrying its own copy of the
pattern.
Each function takes a binary. An adapter that can see a non-binary value keeps its own fallback clause in front of the call.
The functions are @doc false seams with a @spec: callable from tests,
not part of the public API.