Enable stream secrets hiding and batched archiving

Turns on two gluetool-modules features from release 2026-10.1 in the production citool config. Both are off by default.

• config/hide-secrets (new) sets implementation = stream. It redacts files in bounded memory with no size limit, while sed loads whole files and fails above 2 GiB. It also remembers files it verified clean, so later parallel archiving ticks skip them.
• config/archive gets enable-batched-archiving = yes. The progress and execute stages stage their files into one tree, redact it once and transfer it with one rsync --files-from instead of one rsync connection per file. The batch-max-size (256 MiB) and batch-max-files (unlimited) defaults stay.

Both options need worker images 2026-10.1 or newer. Tag release/2026-10.1 after merging, the infrastructure bump points the production workers at ranch-redhat:2026-10.1.

Related: ranch-public!27 (merged)

Generated-by: Claude Code