fix(diagnostics): D2 — redact through homeassistant.helpers.redact (t37)

`homeassistant.util.diagnostic` does not exist — verified against a real
install: `import homeassistant.util.diagnostic` raises ModuleNotFoundError, and
the helper has always lived in `homeassistant.helpers.redact`. The import sat
inside a `try/except ImportError` that set the helper to None, so the
documented G14 pass — the one carrying `_TO_REDACT`, hosts included — silently
did nothing; only the marker scan (pairing-/key-shaped names) masked anything,
which is why the existing test's pairing-code assertion stayed green.

The helper is now imported at MODULE scope from homeassistant.helpers.redact and
applied unconditionally after the marker-name pass. A missing module is a loud
import error at integration load instead of a silent downgrade.

* the diagnostics test now asserts `adb_host` and `protocol_host` really are
  masked in the emitted payload (options and a nested data value);
* TestFaithfulHaStubs asserts the module USES the helper from that path
  (`nsh.diagnostics.async_redact_data is homeassistant.helpers.redact.async_redact_data`),
  that no production module imports the non-existent module (AST), and that the
  try/except ImportError fallback is gone;
* `entity_stublib` gains a faithful `homeassistant.helpers.redact` stub (same
  masking, same nested mapping/list recursion, same None/empty-string skip) so
  the harness meets the import the way a real install does.

Verified: 287 passed, 2 skipped (D2 stage); ruff clean. Full gate re-run on the
completed branch: 289 passed / 2 skipped and 290 passed / 1 skipped.

tests/entity_stublib.py

@@ -10,6 +10,7 @@ import asyncio
 import enum
 import sys
 import types
+from collections.abc import Mapping
 
 import voluptuous_mirror
 
@@ -29,6 +30,7 @@ ENTITIES_STUB_NAMES = (
     "homeassistant.helpers.device_registry",
     "homeassistant.helpers.selector",
     "homeassistant.helpers.event",
+    "homeassistant.helpers.redact",
     "homeassistant.helpers.entity",
     "homeassistant.helpers.entity_platform",
     "nsh.helpers",
@@ -410,6 +412,42 @@ def install() -> None:
     entity_platform.AddEntitiesCallback = object
     helpers.entity_platform = entity_platform
 
+    # t37 D2: homeassistant.helpers.redact.async_redact_data — the REAL helper
+    # (diagnostics.py imports it at module scope; `homeassistant.util.diagnostic`
+    # never existed). Modelled faithfully: the same masking of keys found in
+    # ``to_redact``, the same nested mapping/list recursion, the same skip of
+    # None/empty-string values.
+    redact = types.ModuleType("homeassistant.helpers.redact")
+    redact.REDACTED = "**REDACTED**"
+
+    def _stub_async_redact_data(data, to_redact):
+        if not isinstance(data, (Mapping, list)):
+            return data
+        if isinstance(data, list):
+            return [_stub_async_redact_data(val, to_redact) for val in data]
+        redacted = {**data}
+        for key, value in redacted.items():
+            if value is None:
+                continue
+            if isinstance(value, str) and not value:
+                continue
+            if key in to_redact:
+                if isinstance(to_redact, Mapping):
+                    redacted[key] = to_redact[key](value)
+                else:
+                    redacted[key] = redact.REDACTED
+            elif isinstance(value, Mapping):
+                redacted[key] = _stub_async_redact_data(value, to_redact)
+            elif isinstance(value, list):
+                redacted[key] = [
+                    _stub_async_redact_data(item, to_redact) for item in value
+                ]
+        return redacted
+
+    redact.async_redact_data = _stub_async_redact_data
+    helpers.redact = redact
+    sys.modules["homeassistant.helpers.redact"] = redact
+
     sys.modules["homeassistant.helpers.event"] = event
     sys.modules["homeassistant.helpers.entity"] = entity
     sys.modules["homeassistant.helpers.entity_platform"] = entity_platform