fix: Redact private attributes in migration op events

[keelerm84]

Summary

The MigrationOpEvent serializer wrote the raw evaluation context directly, bypassing the private-attribute redaction applied to every other inline event type. Attributes marked private -- context-declared (_meta.privateAttributes), globally configured, or via all_attributes_private -- were transmitted in plaintext in the migration_op event context in the outgoing analytics payload, even though the same context was redacted in ordinary events.

The privacy settings were threaded into the event but ignored at serialization time.

This serializes the migration context through the same ContextAttributes redaction path used by BaseEvent, extracted into a shared BaseEvent::redacted_context_attributes helper so both serializers stay in sync. Adds regression tests covering global, all-private, context-declared, and anonymous-context redaction.

Reported via BugCrowd. Verified end-to-end against the SDK contract test harness: the new migration redaction tests fail before this change (leaking the private attribute) and pass after.

---

Note

Medium Risk
Touches analytics payload serialization for PII/private attributes; the change reduces exposure but any event-format mistake could affect migration telemetry.

Overview
Fixes a privacy bug where migration_op events inlined the raw evaluation Context, so private attributes could appear in outbound analytics even when other inline events redacted them.

Serialization now uses BaseEvent::redacted_context_attributes(), shared with BaseEvent’s inline path, honoring global private attributes, all_attributes_private, context-declared private attributes, and anonymous redaction. MigrationOpEvent’s serializer switches from base.context to that helper. Four unit tests assert redacted _meta.redactedAttributes for migration op payloads.

^{Reviewed by Cursor Bugbot for commit 456ff41. Bugbot is set up for automated code reviews on this repo. Configure here.}