fix(safety): demote leak detector warn-action logs from warn! to debug!

The leak detector's Warn-action matches (high_entropy_hex pattern on
web search results containing commit SHAs, CSS colors, URL hashes)
were logging at warn! level, corrupting the REPL UI with lines like:
  WARN Potential secret leak detected pattern=high_entropy_hex preview=a96f********cee5

These are informational false positives — real leaks use LeakAction::Redact
which silently modifies the content. Warn-action matches only log for
debugging purposes and should not appear in production output.

Changed to debug! level — visible with RUST_LOG=ironclaw_safety=debug.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

crates/ironclaw_safety/src/leak_detector.rs

@@ -273,10 +273,12 @@ impl LeakDetector {
             });
         }
 
-        // Log warnings
+        // Log warn-action matches at debug level (not warn!) to avoid
+        // corrupting REPL/TUI output. These are informational — real leaks
+        // use LeakAction::Redact which modifies the content silently.
         for m in &result.matches {
             if m.action == LeakAction::Warn {
-                tracing::warn!(
+                tracing::debug!(
                     pattern = %m.pattern_name,
                     severity = %m.severity,
                     preview = %m.masked_preview,