New src/secrets.rs: detection-only heuristic. When thread emits HTML or Markdown without --redact*, scans the rendered bytes for high-precision secret patterns (jwt, apikey, bearer, aws, secretkey, creditcard, ssn) and prints a stderr warning. Detection never mutates output (reads only, preserving the redaction invariant). Patterns are sourced from the single shared REDACT_PRESETS table (no duplication); email/ipv4/uuid are deliberately excluded as routine metadata that would cry wolf. Custom token shapes are NOT caught -- the warning text says so explicitly to avoid false confidence. --i-know suppresses; output stays silent when --redact* already scrubbed it. Scope is HTML (builtin + themed) and Markdown in v1. mbox/maildir are not scanned (they stream to files/dirs without a single in-memory buffer); documented as a best-effort heuristic regardless. 189 passed (was 175; +9 secrets unit + 5 integration), 1 ignored. Co-Authored-By: GLM-5.2 <glm-5.2@z.ai>