secret-guard: count a secret once when bash returns the same output in content and structuredContent

Measured in a full-extension session: one `echo "$SECRET"` was reported as
"redacted ... x2". pi's bash tool returns its output both as content text and
as structuredContent.output, and both are (correctly) redacted. The count
now takes, per name, the highest count from any one field instead of the
sum. A test pins it: it failed before the change and passes after. Re-run
in the full-extension TUI: the warning now reads "redacted SG_TEST_TOKEN
from bash output"; 0 raw copies sent, 0 in the session file. Suite: 46/46.

AGENTS.md

@@ -304,6 +304,9 @@ Read the module header for the incident and for what is not covered.
   identity for untouched values so this is cheap to detect. A handler that
   always returned a copy would rewrite every tool result and every request
   context, for nothing.
+- **Hits are counted per field, then the highest count per name is reported.**
+  pi's bash returns its output twice (content text and `structuredContent.output`),
+  so a sum would report one `echo` as "×2".
 - **The `context` pass walks the whole conversation on every request.** Measured:
   36 ms on a 53 MB session, under 1 ms on a typical one.
 - **End-to-end check** (2026-10-12, real pi on erdc/deepseek-v4.1-flash; the secret