feat(connect): collect bounded offline diagnostics (#6450)

* feat(connect): collect bounded offline diagnostics

* fix(connect): tighten offline diagnostic boundaries

protocol/agent/v1/fixtures/redaction/MANIFEST.sha256

@@ -1,4 +1,4 @@
 38e793226476bdb5f74c704c23ccc0e9ec09d51be3b51791e8b2cdfbf27a5c02  allowed-vectors.json
 014b06540e664f6e38f0174746a418069d2677a2a1a4ef96c17f16dec7e47886  rejection-vectors.json
 fdf1d8f4c7ed6f96026e86c7d89f56e5e08269c0b7a49a1e3c3880e5d023c600  ruleset.json
-5e349d5121037a09a9b1009b08feac9f5fb4b14cd6548419b88bd9f032929b55  secret-vectors.json
+7a4d297943e84b4cea457677762cf3d0d5c2cba35a4aac496befa30ee522b3c0  secret-vectors.json

protocol/agent/v1/fixtures/redaction/secret-vectors.json

@@ -28,6 +28,26 @@
       },
       "expectedRedactedCount": 1
     },
+    {
+      "name": "an S3 access key id adjacent to a Unicode letter",
+      "source": "offline-diagnostic",
+      "valueRule": "AWS_ACCESS_KEY_ID",
+      "ruleSubject": "éAKIAIOSFODNN7EXAMPLE",
+      "document": {
+        "osSummary": "éAKIAIOSFODNN7EXAMPLE",
+        "rustfsVersion": "1.19.4"
+      },
+      "secretLiterals": [
+        "AKIAIOSFODNN7EXAMPLE"
+      ],
+      "expectedCanonicalJson": "{\"osSummary\":\"[REDACTED]\",\"rustfsVersion\":\"1.19.4\"}",
+      "expectedCounts": {
+        "droppedField": 0,
+        "redactedValue": 1,
+        "redactedOversizeValue": 0
+      },
+      "expectedRedactedCount": 1
+    },
     {
       "name": "an S3 secret access key standing alone in an offline OS summary",
       "source": "offline-diagnostic",