Fix allowlist bypass when log arguments span multiple params

[Copilot]

Allowlist context rules failed when the keyword and the secret appeared in separate console.debug arguments — each argument was redacted independently, so the context window never included the preceding keyword.

Changes

• src/format.ts: Replaced per-item redaction with a join-then-redact approach. All arguments are serialized to strings first, joined with a space, then redacted once on the full string — giving context rules a complete view of the message.
• tests/index.test.ts: Added a test covering the multi-argument allowlist case.

Example

setupLogging({ hex: { allow: [{ re: /\b(transfer)\b/i }] } });

// Before: hex was redacted because "transfer" was in a separate arg
console.debug("transfer", "538845bf2f418e0c7f3798d6bcb632273d46633545a5e261feceb7d378ed0761");
// ✗ transfer [REDACTED]

// After: full joined string is evaluated, allowlist matches correctly
// ✓ transfer 538845bf2f418e0c7f3798d6bcb632273d46633545a5e261feceb7d378ed0761

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.