fix(telemetry): stop bearer redaction from eating plain prose

The bearer rule matched any 8+ run of letters after the word, so
package.json prose like "uses bearer authentication" lost its
following word to the placeholder. Real bearer credentials always
carry a digit; require one in the candidate token.

packages/sdk/telemetry/src/secret-redactor.ts

@@ -191,7 +191,12 @@ export class SecretRedactor {
   }
 
   #redactBearerTokens(text: string): string {
-    return text.replace(/(bearer\s+)([a-z0-9._-]{8,})/gi, (_match, prefix: string) => `${prefix}${this.#placeholder}`)
+    // The candidate must contain a digit: real bearer credentials are never
+    // letters-only, while prose like "bearer authentication" is.
+    return text.replace(
+      /(bearer\s+)((?=[a-z._-]*[0-9])[a-z0-9._-]{8,})/gi,
+      (_match, prefix: string) => `${prefix}${this.#placeholder}`,
+    )
   }
 
   #redactStandaloneTokens(text: string): string {

packages/sdk/telemetry/tests/secret-redactor.spec.ts

@@ -154,6 +154,13 @@ describe('SecretRedactor.redactText', () => {
       .toBe(`sending Bearer ${REDACTED} now`)
   })
 
+  it('keeps letters-only prose after the word bearer intact', () => {
+    expect(redactor.redactText('uses bearer authentication for requests'))
+      .toBe('uses bearer authentication for requests')
+    expect(redactor.redactText('"description": "bearer token-helper middleware"'))
+      .toBe('"description": "bearer token-helper middleware"')
+  })
+
   it('redacts standalone secret-shaped tokens while keeping package names and paths', () => {
     expect(redactor.redactText('key sk-abcdefghij1234567890 end'))
       .toBe(`key ${REDACTED} end`)