#472 swamp model get does not redact `sensitive: true` fields (logs/reports/storage do)

Summary

The .meta({ sensitive: true }) schema flag is honored for redaction in logs, report output, and data storage, but swamp model get displays global argument values verbatim with no sensitive-flag check. This is an inconsistency in how the sensitive flag is applied across surfaces, and a potential information-disclosure gap when a sensitive global argument is set to a literal (non-vault-sourced) value.

Where the flag IS honored

• Logs: src/libswamp/models/run.ts:546-568 extracts sensitive field values (via src/domain/models/sensitive_field_extractor.ts) and registers them with SecretRedactor; src/infrastructure/logging/run_file_sink.ts:131 redacts them to *** in per-run logs.
• Reports: src/domain/reports/report_execution_service.ts buildRedactSensitiveArgs() replaces sensitive fields with ***.
• Storage: src/domain/models/data_writer.ts:302-336 vaults sensitive values and replaces them with ${{ vault.get(...) }} references.

Where it is NOT honored

• swamp model get: src/libswamp/models/get.ts:109 copies definition.globalArguments verbatim into ModelGetData, and the renderer src/presentation/renderers/model_get.ts:145-149 prints them through formatRecord with no sensitive-field check in either layer.

Steps to reproduce

1. Define a model type with a global argument marked .meta({ sensitive: true }).
2. Create a model instance and set that argument to a literal value (not a vault.get(...) expression).
3. Run swamp model get <name>.
4. Observe the sensitive value is printed in cleartext under "Global Arguments".

Expected

swamp model get should redact (or vault-reference) fields marked sensitive: true, consistent with logs, reports, and storage.

Notes / scope of risk

Vault-sourced sensitive args are unaffected: ${{ vault.get(...) }} is stored unevaluated in definition.globalArguments, so model get shows the expression, not the secret. The gap only exposes literal/inline sensitive values.

Suggested fix

Redact globalArguments in get.ts against the model type's sensitive schema fields before building ModelGetData, reusing extractSensitiveFields — the same primitive the report path already uses.

Environment

• swamp version: 20260528.175941.0-sha.5d4cfc78