#483 Remediate existing definitions holding cleartext sensitive global arguments (follow-up to #480)

Problem

swamp-club#480 (PR systeminit/swamp#1469) added a guard that refuses new writes of a literal value for a sensitive: true global argument. It does not remediate definitions that already contain a cleartext literal on disk from before the fix.

Two gaps remain:

1. Legacy definitions authored before the guard still hold the secret in cleartext in their YAML until re-saved (and a re-save now fails closed, which can surprise users running methods on such definitions).
2. Datastore sync / migration copies definition YAML files byte-for-byte (src/libswamp/datastores/sync.ts, datastore_migration_service.ts), bypassing the YamlDefinitionRepository.save() chokepoint — so a cleartext literal authored on an older swamp or another machine can land on disk via sync without tripping the guard.

Proposed solution

A swamp doctor-style scan (datastore-aware) that:

• Detects definitions whose sensitive: true global args hold literal (non-vault.get) values.
• Reports them and offers to vault-migrate the value (write to a vault, replace with a vault.get expression) or guides the user to do so.
• Operates at the datastore level so synced/pulled definitions are covered, not just the local repo.

Context

Follow-up to swamp-club#480. The core guard reuses findLiteralSensitiveGlobalArgs in src/domain/models/sensitive_field_extractor.ts, which a remediation sweep can also use.