fix(workflows): redact CEL error values by default; tokenize attachments once

Two follow-ups from PR review.

_fit_attachment_text tokenized the extraction twice on the oversized
path — once for the budget check and once for chars_per_token. That is a
full BPE pass over the whole document (~12ms per 250k chars) on the hot
path of every attachment turn. Compute it once.

The CEL error summarizer kept quoted fragments that looked like
identifiers, on the theory that those are variable names rather than
data. They are not distinguishable: celpy interpolates state values into
messages (`StringType('SECRET')`), and a one-word user query such as
`invoice` is a valid identifier, so it survived redaction and reached
both the log line and — since config errors now bypass
sanitize_api_error — the user. The earlier test passed only because its
sample value contained hyphens.

Quoted fragments are now redacted by default, allowing only the two
positions known to hold names rather than data: the variable in
"undeclared reference to 'x'" and the class in "<class 'ValueError'>".
Tests cover identifier-shaped values, that the exception class survives,
the truncation backstop, and the empty-expression guard.

application/agents/workflows/cel_evaluator.py

@@ -52,12 +52,19 @@ def _summarize_cel_error(exc: Exception) -> str:
     if marker in text:
         text = text.split(marker, 1)[0]
     text = text.strip().lstrip("(").strip()
-    # Quoted fragments in celpy messages are either the offending identifier
-    # (safe, and the useful part) or a state value (not ours to echo). Keep
-    # bare identifiers, redact anything else.
+
+    # Redact quoted fragments by DEFAULT. celpy interpolates state values into
+    # messages (``StringType('SECRET')``), and a value that happens to look
+    # like an identifier is indistinguishable from a variable name — so allow
+    # only the two positions that are known to hold names, not data: the
+    # offending variable in "undeclared reference to 'x'", and the exception
+    # class in "<class 'ValueError'>".
     def _redact(match: "re.Match[str]") -> str:
         inner = match.group(1)
-        return f"'{inner}'" if inner.isidentifier() else "'…'"
+        prefix = text[max(0, match.start() - 14):match.start()]
+        if prefix.endswith("reference to ") or prefix.endswith("<class "):
+            return f"'{inner}'"
+        return "'…'"
 
     text = re.sub(r"'([^']*)'", _redact, text)
     text = text.strip().strip('"').strip()

application/llm/openai.py

@@ -1742,9 +1742,12 @@ class OpenAILLM(BaseLLM):
         # Half the window: the prompt, history and the answer share the rest.
         budget = int(limit * 0.5) if limit else 24000
         try:
-            if num_tokens_from_string(content) <= budget:
+            # Tokenize once: this is a full BPE pass over the whole extraction
+            # (~12ms per 250k chars), on the hot path of every attachment turn.
+            token_count = num_tokens_from_string(content)
+            if token_count <= budget:
                 return content
-            chars_per_token = len(content) / max(num_tokens_from_string(content), 1)
+            chars_per_token = len(content) / max(token_count, 1)
             keep = max(int(budget * chars_per_token * 0.95), 0)
         except Exception:
             keep = budget * 4