security: make router diagnostics content-free by default

Summary

Make normal router diagnostics metadata-only across request, response, cache, tool, provider, embedding, and memory paths. Owner surfaces: src/semantic-router/pkg/extproc/response_log_redaction.go, src/semantic-router/pkg/extproc/utils.go, src/semantic-router/pkg/anthropic/client.go, src/semantic-router/pkg/extproc/req_filter_cache.go, src/semantic-router/pkg/extproc/req_filter_tools.go, and src/semantic-router/pkg/apiserver/route_embeddings.go.

Current behavior

Header redaction is covered, but body mutations, immediate responses, provider bodies, queries, tool text, and rewritten content can still reach normal logs. Log levels and truncation do not establish a confidentiality boundary.

Expected behavior

Normal logs contain correlation metadata, counts, timing, model identity, and approved hashes, never prompt, response, query, tool, or provider content. Exceptional content capture is explicit, short-lived, access-controlled, and separately retained.

Acceptance

• Define and use one content-logging policy at every listed boundary.
• Remove body mutation and immediate-response bytes before proto logging.
• Replace direct content fields with IDs, byte/token counts, latency, model, and approved hashes.
• Gate exceptional content capture by explicit authorization, sampling, expiry, and a separate secure sink.
• Add a static check or focused lint rule that rejects direct logging of known content fields outside the approved helper.

Validation

• Add logger-capture canaries for request/response bodies, immediate responses, provider errors, cache queries, tool arguments, embedding queries, and memory rewrites at INFO, DEBUG, and TRACE.
• Preserve credential-header canary coverage.
• Run cd src/semantic-router && go test -race ./pkg/extproc ./pkg/apiserver ./pkg/anthropic.
• Run the changed-surface make agent-lint and make agent-ci-gate commands reported by the harness.

Related

• Parent audit: #2375
• Security index: #2357
• Credential-header redaction history: #2132