deploy --diff: never diff seeded secret files, redact secret values

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

tests/check-templates.sh

@@ -151,4 +151,22 @@ for c in hosts/*.conf; do
     done
 done
 
+# 10. --diff never touches seed-if-absent secret files, and redacts secret values
+out=$(./deploy.sh --diff hosts/wan.conf 2>&1) || true
+leak=$(echo "$out" | grep -E '/etc/van-gps/config\.json|/etc/van-li3/config\.json|/etc/van-battery/pushover\.json') || true
+if [ -z "$leak" ]; then
+    ok "--diff ignores seeded secret files"
+else
+    bad "--diff mentions seeded secret files"; echo "$leak" | sed 's/^/       /'
+fi
+red=$(printf '%s\n' 'wpa_passphrase=hunter2' '+  "password": "hunter2",' '-  "token": "abc123"' ' "user": "u123"' | ./deploy.sh --redact 2>&1) || true
+if echo "$red" | grep -qE 'hunter2|abc123|u123'; then
+    bad "--redact leaks a secret value"; echo "$red" | sed 's/^/       /'
+elif echo "$red" | grep -q '^wpa_passphrase=' && echo "$red" | grep -q '^+  "password"' \
+     && echo "$red" | grep -q '^-  "token"' && echo "$red" | grep -q '^ "user"'; then
+    ok "--redact masks values, keeps keys and diff markers"
+else
+    bad "--redact lost keys or diff markers"; echo "$red" | sed 's/^/       /'
+fi
+
 exit "$fail"