fix(agent_hub): scrub url credentials, headers and stdio args on outb…

[mushenL]

…ound sync

Change Summary

fix(agent_hub): scrub url credentials, headers and stdio args on outbound sync

The outbound scrubbers only matched secret-named keys and blanked env
blocks, so credentials survived the upload when carried in URL query
strings / userinfo, arbitrary-named HTTP headers, or stdio command-line
flags. Add carrier-level rules to the shared scrubbers and wire in every
framework that collects structured configs (ms-agent, hermes, qwenpaw,
openhuman); clean configs still round-trip byte-identical.

Checklist

• The pull request title is a good summary of the changes - it will be used in the changelog
• Unit tests for the changes exist
• Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
• Documentation reflects the changes where applicable