In `@src/pkg/cli/testdata/redact-config/high-entropy-strings/compose.yaml.golden`:
- Around line 4-8: The ENCRYPTION_KEY value is not being redacted even though it
matches the high-entropy and keyword rules used for SESSION_SECRET and
SIGNING_KEY; update the secret-detection/redaction logic so keys containing
"KEY" (e.g., ENCRYPTION_KEY) get the same treatment as keys containing "SECRET"
by ensuring the keyword detector includes "KEY" (case-insensitive) or that the
high_entropy_string detector is applied regardless of key-name branching with
threshold=4, then regenerate the golden so the value becomes 9f86***; check
functions/modules named like high_entropy_string detector and the keyword
detector/whitelist handling where SESSION_SECRET and SIGNING_KEY are matched.

In `@src/pkg/cli/testdata/redact-config/secrets-in-env-file/.env`:
- Around line 1-4: The .env fixture contains realistic-looking secrets
(GITHUB_TOKEN, DATABASE_URL, POSTGRES_PASSWORD, API_SECRET) which will trigger
secret scanners; update the fixture values to clearly synthetic placeholders
that preserve key names and required formats for tests (e.g.,
GITHUB_TOKEN=ghp_FAKE_TOKEN, DATABASE_URL=postgres://user:pass@host:5432/dbname,
POSTGRES_PASSWORD=FAKE_PASSWORD, API_SECRET=FAKE_SECRET) or alternatively ensure
the testdata path is excluded from your secret-scanner config, then run the
redaction tests to confirm they still exercise the same code paths.

In `@src/pkg/cli/configResolution.go`:
- Around line 36-42: The maskTrailingConfigValue function currently exposes
4-character secrets; change the logic so any value with length <= 4 is fully
masked (return configMaskedValue) instead of returning it unmasked, and for
values longer than 4 keep the visible prefix of the first 4 characters but mask
the rest (use strings.Repeat("*", len(value)-4) rather than a fixed 3 stars) to
avoid revealing suffixes—update maskTrailingConfigValue accordingly.