talm apply: redact secret values in drift preview output #189

The drift preview that talm apply prints to stderr before sending a config walks every leaf field in the on-node vs rendered MachineConfig diff and prints path: oldValue -> newValue. When a secret-bearing field changes between renders (cluster.aescbcEncryptionSecret, cluster.token, cluster.secret, machine.token, cluster.ca.key, etc.), the literal values land in operator stderr — same behaviour as talosctl get machineconfig, but the drift preview runs implicitly on every apply where talosctl get machineconfig is an explicit operator action.

Mitigation worth considering: a redaction allowlist that matches known-secret JSONPaths and substitutes the value with <redacted> while still surfacing the path so the operator sees what changed. Talos's own config schema already marks Sensitive resources at the COSI level (MachineConfigs.config.talos.dev is meta.Sensitive); the same shape could be lifted into a per-path map for the drift formatter.

Scope: extend pkg/applycheck/diff.go::leafDiff (or a new wrapper at the printDriftPreview boundary) to consult a secretPaths allowlist. Default-on. New --show-secrets-in-drift flag for operators who want the raw values for debugging.

Out of scope here: defining the full secret path list — likely needs a sweep through Talos's v1alpha1 config types to enumerate every Sensitive-marked field.