fix(diagnostics): D2 — redact through homeassistant.helpers.redact (t37)

`homeassistant.util.diagnostic` does not exist — verified against a real
install: `import homeassistant.util.diagnostic` raises ModuleNotFoundError, and
the helper has always lived in `homeassistant.helpers.redact`. The import sat
inside a `try/except ImportError` that set the helper to None, so the
documented G14 pass — the one carrying `_TO_REDACT`, hosts included — silently
did nothing; only the marker scan (pairing-/key-shaped names) masked anything,
which is why the existing test's pairing-code assertion stayed green.

The helper is now imported at MODULE scope from homeassistant.helpers.redact and
applied unconditionally after the marker-name pass. A missing module is a loud
import error at integration load instead of a silent downgrade.

* the diagnostics test now asserts `adb_host` and `protocol_host` really are
  masked in the emitted payload (options and a nested data value);
* TestFaithfulHaStubs asserts the module USES the helper from that path
  (`nsh.diagnostics.async_redact_data is homeassistant.helpers.redact.async_redact_data`),
  that no production module imports the non-existent module (AST), and that the
  try/except ImportError fallback is gone;
* `entity_stublib` gains a faithful `homeassistant.helpers.redact` stub (same
  masking, same nested mapping/list recursion, same None/empty-string skip) so
  the harness meets the import the way a real install does.

Verified: 287 passed, 2 skipped (D2 stage); ruff clean. Full gate re-run on the
completed branch: 289 passed / 2 skipped and 290 passed / 1 skipped.

tests/test_command_routing.py

@@ -994,10 +994,16 @@ class TestEntryDiagnostics:
         from types import SimpleNamespace as DiagEntry
 
         entry = DiagEntry(
-            data={},
+            data={
+                "name": "Shield",
+                "androidtv_entity": "media_player.shield",
+                "nested": {"adb_host": "10.0.0.5"},
+            },
             options={
                 "adb_command_enabled": True,
                 "protocol_pairing_code": "4821",
+                "adb_host": "192.168.1.50",
+                "protocol_host": "192.168.1.50",
             },
             title="Shield",
         )
@@ -1010,6 +1016,14 @@ class TestEntryDiagnostics:
         payload = await async_get_config_entry_diagnostics(None, entry)
 
         assert payload["entry"]["options"]["protocol_pairing_code"] == "**REDACTED**"
+        # t37 D2: the G14 field list (hosts included) really applies now — the
+        # old import pointed at homeassistant.util.diagnostic, which does not
+        # exist, so this pass silently did nothing and only the marker scan
+        # (pairing-/key-shaped names) masked anything.
+        assert payload["entry"]["options"]["adb_host"] == "**REDACTED**"
+        assert payload["entry"]["options"]["protocol_host"] == "**REDACTED**"
+        assert payload["entry"]["data"]["nested"]["adb_host"] == "**REDACTED**"
+        assert payload["entry"]["data"]["androidtv_entity"] == "media_player.shield"
         assert payload["entry"]["options"]["adb_command_enabled"] is True
         assert "awake" in payload["store"]
         assert payload["transport"]["adb"]["connected"] is not None
@@ -1062,6 +1076,43 @@ class TestFaithfulHaStubs:
                 domain="nvidia_shield",  # G18 keyword of BrowseMediaSource only
             )
 
+    def test_redaction_uses_the_real_helper_module(self):
+        import homeassistant.helpers.redact as redact
+        import nsh.diagnostics as diagnostics
+
+        assert redact.REDACTED == "**REDACTED**"
+        # the module actually USES the helper from the real module path
+        assert diagnostics.async_redact_data is redact.async_redact_data
+        assert {"adb_host", "protocol_host"} <= diagnostics._TO_REDACT
+        assert diagnostics._REDACTED == redact.REDACTED
+
+    def test_no_production_module_imports_the_nonexistent_diagnostic_module(self):
+        """t37 D2: `homeassistant.util.diagnostic` never existed."""
+        offenders = [
+            f"{path.name}:{node.lineno}"
+            for path in sorted(_SHIELD_DIR.glob("*.py"))
+            for node in ast.walk(ast.parse(path.read_text(encoding="utf-8")))
+            if isinstance(node, ast.ImportFrom)
+            and node.module == "homeassistant.util.diagnostic"
+        ]
+        assert offenders == []
+
+    def test_diagnostics_has_no_silent_import_fallback(self):
+        """The redaction import is at module scope — loud, not swallowed."""
+        tree = ast.parse(
+            (_SHIELD_DIR / "diagnostics.py").read_text(encoding="utf-8")
+        )
+        caught = [
+            handler
+            for node in ast.walk(tree)
+            if isinstance(node, ast.Try)
+            for handler in node.handlers
+            if isinstance(handler.type, ast.Name)
+            and handler.type.id == "ImportError"
+        ]
+        assert caught == []
+
+
 class TestBrowseMediaDirectory:
     """P4-2c: the app directory root and its launch path."""