fix(core): sanitize MessageBus logs and make publish calls resilient

- Added sanitization to MessageBus.publish() logs and error messages using sanitizeToolArgs to prevent secret leakage.

- Refactored floating publish() calls to use a type-safe resiliency pattern (instanceof Promise) to handle test mocks and sync throws.

Fixes CI failures and addresses security review feedback.

packages/cli/src/test-utils/AppRig.tsx

@@ -609,13 +609,15 @@ export class AppRig {
         this.removeToolPolicy(pending.toolName);
       }
 
-      // eslint-disable-next-line @typescript-eslint/no-floating-promises
-      messageBus.publish({
+      const p = messageBus.publish({
         type: MessageBusType.TOOL_CONFIRMATION_RESPONSE,
         correlationId: pending.correlationId,
         confirmed: outcome !== ToolConfirmationOutcome.Cancel,
         outcome,
       });
+      if (p instanceof Promise) {
+        p.catch(() => {});
+      }
     });
 
     await act(async () => {