SafeText.redactCredentials used String.indexOf as a startsWith test to
keep diagnostic lookahead bytes out of display text. QML's V4 engine
returns -1 for "".indexOf("") where ECMAScript returns 0, so an empty
(no-error) message hit the guard and returned "[redacted]". The popup's
error binding then showed a red InlineMessage on every provider, and the
update check could report "[redacted]" instead of "no error".

Replace the indexOf startsWith test with an explicit slice comparison,
which is engine-independent, and add a QML regression test asserting
empty and whitespace-only messages stay empty. Update the static
security assertion to pin the new comparison.