fix(M11): propagate PipelineCriticalError, redact configured secrets, signal blog failures

Correct 4 findings from the independent M11 review:

#1 (Critical) — PipelineCriticalError was downgraded to PipelineWarning:
  - Add except PipelineCriticalError: raise before each except Exception
    in all 5 non-blocking steps (fetch_blog, compare, caldav_sync, synthesis, send)
  - Critical errors now propagate to the outer handler and stop the pipeline

#2 (Critical) — redact_exception() did not use configured secrets:
  - Extend redact_exception() with extra_secrets parameter (upward compatible)
  - Harden redact_secrets(): sort extra_secrets by length descending
  - Add Settings.redaction_secrets() collecting all 6 SecretStr fields
  - Add PipelineRunner._redact(exc) using self._redaction_secrets
  - All except blocks in run() now use self._redact(exc)
  - CalDAV FAILED-status path uses full redaction_secrets collection

#3 (Medium) — BlogRSSClient silently swallowed failures:
  - Add error field to BlogRSSFetchResult
  - rss.py sets error on failure paths (except Exception, bozo/invalid feed)
  - fetch_blog_step raises RuntimeError when result.error is set
  - PipelineRunner now produces PipelineWarning for blog failures

#4 (Medium) — Test coverage at 80%, now 91%:
  - 11 new integration tests covering blog failure/success, compare failure,
    CalDAV failure (exception + FAILED status), send False/exception,
    PipelineCriticalError propagation, secret redaction with sentinel,
    empty agenda/homework, iCal cache cleanup
  - Secret redaction test uses mock (no network) and proves configured-secret
    propagation via non-URL sentinel in RuntimeError

Validation: 619 tests pass, ruff/mypy/bandit/pre-commit green, coverage 91%.

Co-authored-by: opencode/coder <coder@agents.invalid>
Co-authored-by: opencode/test-engineer <test-engineer@agents.invalid>

pronote_sync/pipeline/run.py

@@ -97,6 +97,7 @@ class PipelineRunner:
         :param now_provider: Horloge injectée pour rendre l'exécution testable.
         """
         self._settings = settings
+        self._redaction_secrets = settings.redaction_secrets()
         self._pronote_fetcher = pronote_fetcher
         self._caldav_synchronizer = caldav_synchronizer
         self._agenda_comparator = agenda_comparator
@@ -153,6 +154,15 @@ class PipelineRunner:
             update={"app": self._settings.app.model_copy(update={"dry_run": self._dry_run})}
         )
 
+    def _redact(self, exc: Exception) -> str:
+        """Rédige une exception avec les secrets configurés.
+
+        :param exc: Exception dont le message doit être masqué.
+        :return: Message d'erreur avec secrets configurés remplacés par ``REDACTED``.
+        :rtype: str
+        """
+        return redact_exception(exc, self._redaction_secrets)
+
     def _run_context(self) -> AbstractContextManager[None]:
         """Retourne le contexte isolant les éventuels caches de source.
 
@@ -195,14 +205,18 @@ class PipelineRunner:
 
                 try:
                     blog_articles = fetch_blog_step(self._blog_client, self._blog_state)
+                except PipelineCriticalError:
+                    raise
                 except Exception as exc:
-                    self._warn("fetch_blog", redact_exception(exc))
+                    self._warn("fetch_blog", self._redact(exc))
                     blog_articles = []
 
                 try:
                     agenda_diff = compare_step(self._agenda_comparator, data)
+                except PipelineCriticalError:
+                    raise
                 except Exception as exc:
-                    self._warn("compare", redact_exception(exc))
+                    self._warn("compare", self._redact(exc))
                     from pronote_sync.models.diff import AgendaDiff
 
                     agenda_diff = AgendaDiff(target_date=data.target_date)
@@ -214,13 +228,13 @@ class PipelineRunner:
                     if sync_result.status is CalDAVSyncStatus.FAILED:
                         caldav_errors = redact_secrets(
                             "; ".join(sync_result.errors),
-                            extra_secrets=(effective_settings.caldav.password,)
-                            if effective_settings.caldav.password is not None
-                            else (),
+                            extra_secrets=self._redaction_secrets,
                         )
                         self._warn("caldav_sync", caldav_errors or "Échec CalDAV")
+                except PipelineCriticalError:
+                    raise
                 except Exception as exc:
-                    self._warn("caldav_sync", redact_exception(exc))
+                    self._warn("caldav_sync", self._redact(exc))
 
                 try:
                     synthesis = synthesis_step(
@@ -232,8 +246,10 @@ class PipelineRunner:
                             target_date=data.target_date,
                         ),
                     )
+                except PipelineCriticalError:
+                    raise
                 except Exception as exc:
-                    self._warn("synthesis", redact_exception(exc))
+                    self._warn("synthesis", self._redact(exc))
                     synthesis = None
 
                 message = XmppMessage(
@@ -250,15 +266,17 @@ class PipelineRunner:
                     try:
                         if not send_step(self._channel, message):
                             self._warn("send", "Le canal XMPP a refusé l'envoi")
+                    except PipelineCriticalError:
+                        raise
                     except Exception as exc:
-                        self._warn("send", redact_exception(exc))
+                        self._warn("send", self._redact(exc))
                 return data, [*self._errors, *self._warnings]
         except PipelineCriticalError as exc:
             logger.error("Erreur critique du pipeline : %s", exc.message)
             self._errors.append(exc)
         except Exception as exc:
             error = PipelineCriticalError(
-                f"Erreur inattendue du pipeline : {redact_exception(exc)}", step="pipeline"
+                f"Erreur inattendue du pipeline : {self._redact(exc)}", step="pipeline"
             )
             logger.error("Erreur critique du pipeline : %s", error.message)
             self._errors.append(error)

pronote_sync/pipeline/steps/fetch_blog.py

@@ -24,6 +24,8 @@ def fetch_blog_step(client: BlogRSSClient | None, state: BlogRSSState | None) ->
         result = client.fetch_and_parse(
             known_guids=state.get_known_guids(), etag=etag, last_modified=last_modified
         )
+        if result.error is not None:
+            raise RuntimeError(result.error) from None
         if not result.not_modified:
             state.add_guids(article.id for article in result.articles)
             state.update_cache_headers(result.etag, result.last_modified)