Reuse credential discovery and diagnostic redactors

internal/framework/runner/runner_test.go

@@ -913,10 +913,11 @@ func TestRunnerApplyConflictAfterTwoInitiallyValidDeletions(t *testing.T) {
 func ptrConfig(c config.Config) *config.Config { return &c }
 
 type fakeStructuredClient struct {
-	responses []validators.LLMValidationResponse
-	secrets   []string
-	err       error
-	calls     int
+	responses      []validators.LLMValidationResponse
+	secrets        []string
+	preparedSecret string
+	err            error
+	calls          int
 }
 
 func (f *fakeStructuredClient) ConfiguredSecrets(context.Context) []string { return f.secrets }
@@ -925,6 +926,10 @@ func (f *fakeStructuredClient) CompleteStructured(ctx context.Context, req contr
 	_ = ctx
 	_ = req
 	f.calls++
+	if f.preparedSecret != "" {
+		f.secrets = append(f.secrets, f.preparedSecret)
+		f.preparedSecret = ""
+	}
 	if f.err != nil {
 		return contracts.StructuredCompletionResponse{}, f.err
 	}
@@ -1152,7 +1157,8 @@ func TestRunnerLLMValidatorDiagnosticsWrittenAndRedacted(t *testing.T) {
 	validationSecret := "runner-validation-secret"
 	client := &fakeStructuredClient{responses: []validators.LLMValidationResponse{{Validations: []validators.LLMValidationDecision{{CorrectionIndex: 1, Approved: true, Confidence: 0.9, Reason: validationSecret}}}}}
 	llmValidator, _ := validators.NewLLMBackedValidator("spoken_form_plausibility_review", validators.LLMValidatorTypeSpokenFormPlausibility)
-	client.secrets = []string{primarySecret, validationSecret}
+	client.secrets = []string{primarySecret}
+	client.preparedSecret = validationSecret
 	cfg := runnerTestConfig()
 	diagDir := t.TempDir()
 	r := New(fakeFactory{modules: map[string]contracts.TranscriptModule{