Please address the comments from this code review:

## Overall Comments
- In `buildDoctorReport`, several diagnostics (e.g., `checkGcloudInstalled`, `getActiveAccount`, `checkAdc`, `checkEnvironmentDetailed`) are called without individual `try/catch` guards, so a failure in any one of them will abort the whole support bundle; consider wrapping each diagnostic in its own error handling and downgrading failures to WARN lines so the bundle is still generated with partial data.
- The `support bundle` action currently mixes CLI wiring with non-trivial business logic (building reports, copying files, calling PowerShell); consider extracting the report-building and bundling logic into separate reusable functions/modules to keep the command handler thin and easier to test and extend.

## Individual Comments

### Comment 1
<location> `src/commands/support.ts:45` </location>
<code_context>
+        `Service: ${serviceInstalled ? (serviceRunning ? 'RUNNING' : 'STOPPED') : 'NOT INSTALLED'}`,
+        `Process: ${processRunning ? 'RUNNING' : 'STOPPED'}`,
+        `Instance: ${config.selectedInstance || 'Unknown'}`,
+        `Port: ${config.proxyPort || 5432}`,
+    ];
+
</code_context>

<issue_to_address>
**issue:** Using `||` to default the port will treat `0` as falsy, which may be unintended.

If `config.proxyPort` can validly be `0` (or another falsy value like `NaN`), this will incorrectly fall back to `5432`. If you only want a default when the value is `null` or `undefined`, prefer `config.proxyPort ?? 5432`.
</issue_to_address>

### Comment 2
<location> `src/commands/support.ts:132-133` </location>
<code_context>
+            await fs.writeFile(path.join(stagingDir, 'status.txt'), await buildStatusReport());
+            await fs.writeFile(path.join(stagingDir, 'doctor.txt'), await buildDoctorReport());
+
+            if (await fs.pathExists(PATHS.CONFIG_FILE)) {
+                await fs.copy(PATHS.CONFIG_FILE, path.join(stagingDir, 'config.json'));
+            } else {
+                await fs.writeFile(path.join(stagingDir, 'config-missing.txt'), 'config.json not found');
</code_context>

<issue_to_address>
**🚨 suggestion (security):** Copying the raw config into the bundle may leak sensitive information.

`config.json` can contain secrets (tokens, credentials, project IDs, etc.), so copying it as-is into the bundle is risky. Consider redacting known sensitive fields or generating a minimal, non-sensitive config view for the bundle, and make an explicit decision about which fields are safe to include.

Suggested implementation:

```typescript
            await fs.writeFile(path.join(stagingDir, 'status.txt'), await buildStatusReport());
            await fs.writeFile(path.join(stagingDir, 'doctor.txt'), await buildDoctorReport());

            if (await fs.pathExists(PATHS.CONFIG_FILE)) {
                const SENSITIVE_KEY_PATTERN = /(token|secret|password|key|credential|project[_-]?id|client[_-]?id)/i;

                const redactConfig = (value: unknown): unknown => {
                    if (Array.isArray(value)) {
                        return value.map(redactConfig);
                    }

                    if (value && typeof value === 'object') {
                        const result: Record<string, unknown> = {};
                        for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
                            if (SENSITIVE_KEY_PATTERN.test(k)) {
                                result[k] = '[REDACTED]';
                            } else {
                                result[k] = redactConfig(v);
                            }
                        }
                        return result;
                    }

                    // Primitive values are left as-is unless their key was flagged above.
                    return value;
                };

                try {
                    const rawConfig = await fs.readFile(PATHS.CONFIG_FILE, 'utf8');
                    const parsedConfig = JSON.parse(rawConfig);
                    const redactedConfig = redactConfig(parsedConfig);

                    await fs.writeFile(
                        path.join(stagingDir, 'config-redacted.json'),
                        JSON.stringify(redactedConfig, null, 2),
                        'utf8'
                    );
                } catch (err) {
                    await fs.writeFile(
                        path.join(stagingDir, 'config-error.txt'),
                        `Failed to process config.json: ${(err as Error).message}`,
                        'utf8'
                    );
                }
            } else {
                await fs.writeFile(path.join(stagingDir, 'config-missing.txt'), 'config.json not found');
            }

```

- If there are other places in the codebase or documentation that reference `config.json` in the support bundle, update them to point to `config-redacted.json` and/or describe the new redaction behavior.
- You may want to tune `SENSITIVE_KEY_PATTERN` based on your actual config schema (e.g., adding/removing field names) to better balance usefulness vs. privacy.
</issue_to_address>