feat(e13): plan smart add onboarding + S1 local blobparse redaction library

[imneov]

What

Lands the E13 — Smart `add` Onboarding plan and its first substrate story.

Planning (docs):

• docs/decisions/0003-smart-add-scope.md — ADR-0003. Adds env/file/paste input sources to add. The only network path is an opt-in, secret-free --ai parse; it narrowly amends ADR-0001 Decision 8 for that path only. Every other E13 path is zero-network.
• docs/plan/epics.md — E13 epic entry (5 stories).
• docs/plan/stories/E13-S1..S5.md — story specs.

Code (E13-S1):

• internal/blobparse — pure, local, deterministic extractor. Given arbitrary pasted text it returns the extracted core fields plus a desensitized copy in which no secret-shaped token survives ("strip on doubt"). Substrate for E13-S4 (--from-text) and E13-S5 (--ai).

Review trail

Fresh-context adversarial review flagged a Critical gap: bare unlabeled secrets (Google AIza…, 40-hex, base64 blobs) survived desensitization, and the property test reused production patterns as its own oracle (self-certifying). Remediated in 210ad03:

• Expanded secret-shape coverage + a conservative high-entropy fallback (URLs / base_url preserved).
• Test oracle rewritten independently of production patterns; corpus expanded.
• Provider inference now follows the selected api_key/base_url (coherent draft).

Independently verified with an oracle not derived from production regexes: AIza…, 40-hex, base64 blob, bare/(wrapped) sk- all redact to placeholders while base_url=https://… is preserved.

Scope / safety

• Zero network in this PR. No cmd/ wiring yet (S4 does that).
• ⚠️ ADR-0003's network amendment (S5 --ai) is not exercised here and remains flagged for final sign-off.

🤖 Generated with Claude Code