Harden RECONCILE.md §5: no raw component bodies to logs

[behobu]

Adds a §5 rule forbidding the reconciler from echoing raw component API response/request bodies (which carry config.settings), requiring redaction at the source. Addresses the self-flagged gap from apply run 29613909589. Docs-only — plan should report all NO-OP.

[github-actions]

Monad reconcile plan

Monad reconcile plan — org jfrog-417c (1f371e3e-09f1-4bd3-8302-33d130d1c659)

NO-OP   input:org-cloudtrail-logs
NO-OP   transform:drop-low-value-fields
NO-OP   transform:drop-cloudtrail-duplicated-data
NO-OP   output:sink
NO-OP   pipeline:cloudtrail

Pipelines: NO-OP pipeline:cloudtrail

Summary: 0 create, 0 update, 0 prune, 5 no-op

Details:
- All 5 lockfile entries have a corresponding desired file under monad/** (no prune candidates).
- All 5 lockfile ids were confirmed live via GET (200 OK, no self-heal needed):
  - input:org-cloudtrail-logs -> f117e470-88d5-42aa-9a92-d94f02d8bfe0
  - transform:drop-low-value-fields -> 9389d835-fae5-4910-aa23-2a90d088f203
  - transform:drop-cloudtrail-duplicated-data -> cf4aabfa-f217-42cd-b326-947bf7d0877f
  - output:sink -> 983f3aa9-5ca9-47df-bae7-b03606720c7a
  - pipeline:cloudtrail -> b55236eb-c8c2-4d43-b0fe-c9f6b9f011c0
- sha256(canonical_json(spec)) for each desired object (secrets block dropped) matches
  last_applied_hash in .monad-lock.json exactly -> no updates required.
- No secret literals found in monad/**; all sensitive settings (bucket, role_arn) use
  env:VAR_NAME pass-through refs as required (not resolved or printed in this plan).
- Zero writes made to the Monad API and .monad-lock.json was not modified (MODE=plan).