Include redacted commands in failure bundles

Automatic failure bundles preserved stdout, stderr, timing, lease metadata, and run information, but did not record the command that produced the failure. Once terminal history was gone, a recipient could inspect how a run failed but not reliably identify or replay what ran.

Threaded the existing normalized command display into FailureCaptureMetadata and wrote it as a redacted command field in crabbox-run.json using the established diagnostic redactor at the archive metadata boundary.

• Improves failure-bundle handoff value for local-container and coordinatorless debugging workflows.
• Keeps command context useful while honoring the existing caller-review and redaction boundary for diagnostic archives.
• Adds metadata without requiring configuration, secret migration, or package-version changes.

• Added focused failure-bundle tests covering configured, profile, forwarded, structural, repeated, overlapping, and harmless command-context redaction cases.
• Ran focused tests under the race detector, full internal CLI tests, go vet, go build, and git diff whitespace checks.
• Verified a live coordinatorless local-container failure run retained command context, redacted credential forms across archive entries, and completed lease cleanup.