fix(cli): redact the provision code in the intercept upgrade check line

`ctrld start --cd-org <code>` logged its arguments as-is in the debug line
`intercept upgrade check: args=[...]`. redactedArgs formats them through
redactSecrets with provisionSecrets, covering --cd-org and both parts of
--cd, in either flag form.

cmd/cli/cli.go

@@ -952,6 +952,22 @@ func provisionSecrets() []string {
 	return []string{cdUID, cdOrg, uid, clientID}
 }
 
+// redactedArgs formats command-line arguments for a log line with the
+// provision secrets removed. "ctrld start --cd-org <code>" carries the code
+// in its arguments, and a code enrolls endpoints into the organization until
+// it expires or runs out.
+func redactedArgs(args []string) string {
+	return redactSecrets(fmt.Sprint(args), provisionSecrets()...)
+}
+
+// interceptUpgradeCheckLine is the debug line "ctrld start" logs before its
+// intercept upgrade check. It is built here, not inline, so a test can hold the
+// line itself, not only redactedArgs, to never carrying a provision secret.
+func interceptUpgradeCheckLine(args []string, interceptOnly, svcConfigExists bool, mode string) string {
+	return fmt.Sprintf("intercept upgrade check: args=%s interceptOnly=%v svcConfigExists=%v interceptMode=%q",
+		redactedArgs(args), interceptOnly, svcConfigExists, mode)
+}
+
 // uninstallInvalidCdUIDFn is a var so tests can observe the self-uninstall
 // without driving the OS service manager.
 var uninstallInvalidCdUIDFn = uninstallInvalidCdUID