Move secret masking from runtime (task.go) to compile time (variables.go).
This avoids recalculating variables on each log.
- Add MaskSecretsWithExtra for loop vars and deferred commands
- Rename CmdTemplate to LogCmd (clearer intent)
- Simplify logging in runCommand