fix(redaction): omit remaining configuration values from refusals (#1873)

scripts/test-task.sh

@@ -317,7 +317,7 @@ EOF
             && printf '%s\n' "$V2_OUT" | grep -q '^MOSAIC_ROLE_NETWORK=api-only$' || V2_OK=1
     done
     check "shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)" "$V2_OK"
-    printf '# v2\n' > "$SANDBOX/roles/v2.md"
+    printf '# v2\n\n## Authority\n' > "$SANDBOX/roles/v2.md"
     v2role() { # v2role NAME AUTHORITY_JSON CREDENTIALS_JSON [CONTRACT]
         printf '{"roleVersion":2,"name":"%s","title":"T","contract":"%s","tools":["read"],"network":"none","authority":%s,"credentials":%s}' \
             "$1" "${4:-v2.md}" "$2" "$3" > "$SANDBOX/roles/$1.json"