Reuse credential discovery and diagnostic redactors

internal/framework/llm/runtime.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"path/filepath"
 	"strings"
+	"sync"
 	"sync/atomic"
 
 	"gitea.maximumdirect.net/eric/audita/v3/internal/core/config"
@@ -19,10 +20,12 @@ import (
 
 // Runtime owns the captured engine shared by all processing clients.
 type Runtime struct {
-	Config      config.Config
-	Engine      *pk.Engine
-	SourcePaths []string
-	nextCallID  atomic.Uint64
+	Config                config.Config
+	Engine                *pk.Engine
+	SourcePaths           []string
+	nextCallID            atomic.Uint64
+	credentialSourcesOnce sync.Once
+	credentialEnvNames    map[string]struct{}
 }
 
 type AssetError struct{ Err error }