logging: the instance's slog policy, without the handler

middleware.RecoverPanics reports panics through slog's default logger, so
ecore already depends on every service installing a compatible handler and
had no way to say so. A service that forgets slog.SetDefault prints its
panic reports in Go's plain format, unlevelled and unmasked, into a journal
where everything else is tinted.

Six services (compare, spec, dolt, cover, bench, tokens) had each written
the same level parser, the same os.Stderr.Stat colour probe, the same -d
scan of os.Args, and their own copy of the credential mask list. The copies
had drifted into three key sets and four patterns: only spec masked the
config private keys, only tokens-migrate knew a DSN carries a password, and
only dolt masked pubkey and credential. What is redacted — the unified-login
cookie, tokens.sr.ht working tokens, the Authorization header they ride in —
is a fact about the instance, so it is maintained once.

Defaults() resolves the policy and Install() sets the default logger; the
handler stays with the caller, because ecore is a small SourceHut library
and auxilia is a large general one, and a service that wants a JSON handler
for a log shipper should not link a tinting one to share a mask list.
Options.ReplaceAttr applies the same masking through stdlib slog alone, so
the split costs a non-scribe service nothing. tokens.sr.ht's partial mask is
exported but not defaulted: six characters of a live working token is still
six characters of a live working token.

Level: -d, then $LOG_LEVEL, then [section]log-level, then info; an
unreadable value falls through to the next source rather than refusing to
boot.