Collect customer-safe diagnostics

Collect the following after setting umask 077: keystone-gateway version; node-id --config ...; systemctl status keystone-gateway; curl results for /healthz and /readyz; authenticated /v1/status, /v1/license, /v1/entitlements, /v1/ha; recent journalctl -u keystone-gateway; listening ports (ss -ltnp); peer/Collector connectivity results; and a JSON support report. Capture the correlation ID from failed API responses. Before sending logs or command output, inspect it for credentials and remove or replace the affected lines. Startup failures are printed to stderr before normal structured logging, so do not assume the log redactor covers every diagnostic path.

Provide a redacted configuration that preserves key names and addresses but replaces secret values with REDACTED. Do not collect or transmit private keys, state-encryption keys, bearer tokens, telemetry authorization headers, passwords, unredacted credential files, credential-bearing URLs, or sensitive certificate material. Do not paste raw errors, request/configuration objects, or command lines containing secrets. License metadata is usually sufficient; do not send a raw signed license unless support explicitly provides an approved secure channel.