Replace derived Deserialize with a custom impl that rejects private_key == b"[REDACTED]" with an explicit error, and make the custom Serialize impl always redact (drop the human-readable-only branch). Updates the redaction-rejection and debug-no-leak tests. Resolves drift item #5 (ADR-025 dropped the postcard/remote path).