Defer maybe_redact to flush_chunks() boundary

**Parent:** #621

`crates/zeph-core/src/agent/streaming.rs:495` — `maybe_redact` allocates per SSE chunk when redaction is enabled. Defer to `flush_chunks()` to reduce N allocations to 1 per turn.