Fix verifier boundary and credential redaction edge cases

[moortekweb-art]

Summary

• Tighten verifier manifest parsing for Gradle test root alias indirection and fail-closed behavior.
• Extend credential redaction for compound PAT-style keys.
• Add tests for redaction, Gradle alias handling, and fail-closed inference.

Why

Closes remaining boundary gaps found in verifier + redaction checks and supports safer defaults for unrecognized alias-style Gradle roots.

Validation

• uv run pytest tests/test_gui_api.py
• uv run pytest tests/test_verified_tournament.py
• uv run ruff check on changed files