[PROD-004] .NET production config loader and redaction

[ktalpay]

Task ID: PROD-004
Lane: dotnet
Status: merged
Agent: dotnet-agent
Depends on: PROD-003

Goal:
Add the .NET production configuration loader and redaction boundary required by the production parity contract.

Scope:

• Support explicit config file plus environment input for the .NET service entrypoint.
• Validate required production keys fail-closed.
• Report secret presence without printing secret values.
• Redact connection strings, passwords, tokens, and credential-bearing URLs from diagnostics.
• Wire the boundary into validate-config.
• Do not connect to PostgreSQL.
• Do not implement source ingestion or DB writes.

Acceptance:

• validate-config uses the real .NET config boundary.
• Missing/invalid config fails closed with actionable diagnostics.
• Secret values are never printed.
• Tests cover config file + env merge, missing values, invalid values, and redaction.
• No production credentials or generated artifacts.

Task-ID: PROD-004

[github-actions]

Agent Task Watcher updated task status.

Detected task: PROD-004
Merged PR: #620
Task issue status: status:missing -> status:merged

Downstream task update summary:

No dependent tasks were declared in Unblocks:.