[Security] Redact persisted secrets and harden controller file permissions

[fettpl]

Summary

• redact known secret material before controller and engine output reaches console, files, streams, events, or retained failure tails
• make controller, engine, Docker, installer, and existing-install log boundaries owner-only and persistence-bounded
• preserve exact process ownership through the redaction proxy so crash and orphan cleanup cannot signal unrelated processes
• require the supported Bun runtime in the controller installer and fail clearly when it cannot be installed

Root cause

Controller and engine output could reach raw persistence paths before API-level redaction, while sensitive files inherited ambient filesystem modes. Direct engines and Docker also needed a redaction boundary that preserved the real worker identity and cleanup authority without introducing a second competing process owner.

Solution design

• One idempotent structured redactor handles nested and repeatedly serialized values, every Authorization scheme, known credential fields, URLs, and synthetic sentinel values before any sink.
• Log directories and files are created and repaired with owner-only modes, reject unsafe symlinks, and use bounded persistence rather than unbounded append-only output.
• Direct engines run behind a typed redaction proxy while retaining the real child PID and exact process-group identity. Cleanup revalidates immutable process identity and refuses unproved or PID-reused targets.
• Docker uses --log-driver none and an exact start --attach stream through the same redaction boundary, so the daemon does not retain raw output while Local Studio keeps a bounded redacted diagnostic log.
• Proxy failure closes the proven Local Studio-owned process boundary without abandoning descendants or broadening orphan cleanup beyond [Security] Scope orphan cleanup to Local Studio-owned processes #370's ownership model.
• The installer establishes an owner-only umask, repairs existing credential/log modes, precreates private paths, and enforces the repository-supported Bun version with tested old/exact/new handling.

Security invariants

• Raw known credentials never reach default console, file, event, stream, Docker-daemon, or failure-tail storage.
• Redaction is idempotent and handles nested/double-serialized structured values without logging the original value on error paths.
• Cleanup signals only a revalidated Local Studio-owned PID/process group; an unproved group or reused PID fails closed.
• Sensitive directories are 0700 and files are 0600 on supported Unix filesystems, including repaired existing installs.
• Tests use synthetic sentinels only.

Dependency

Depends on #370. Merge #370 first, then rebase this branch onto current dev, resolve any conflicts, and rerun all gates, comparable coverage, independent exact-head review, and signing-aware desktop acceptance before merge.

Validation

• Exact head: 6f32fa36050226fd0be74f5808dfe46af8f095fa.
• npm run check passed: release 12/12, frontend 123/123, controller 119/119, and agent runtime 97/97.
• npm run test:integration passed: 97/97.
• Focused redaction/process regressions passed 29/29 in three consecutive Bun 1.3.14 runs.
• Comparable controller coverage versus [Security] Scope orphan cleanup to Local Studio-owned processes #370 rose from 42.03% to 42.85% functions and from 52.17% to 52.97% lines; tests increased from 97 to 119.
• Installer shell syntax, diff integrity, static, type, lint, standards, cleanup, dependency, and standalone gates passed.
• Fresh independent exact-head P0/P1 review: READY with no findings.
• Exact-head desktop:dist completed successfully.
• Electron Builder found zero valid signing identities and skipped signing. The repository-supported stable installer failed before mutation with code has no resources but signature indicates they must be present; /Applications/Local Studio.app remained unchanged.
• No ad-hoc/dev signing or installation path was used, so relaunch and installed GET /api/desktop-health acceptance are not claimed.

Closes #229

Maintainer review requested in the PR discussion.

[fettpl]

@0xSero, maintainer update: #378 is the focused current-dev replacement for #229 at independently reviewed exact head 6f32fa36050226fd0be74f5808dfe46af8f095fa.

It redacts known credentials before every controller/engine sink, bounds owner-only persistence, disables raw Docker daemon logs in favor of redacted attach output, and preserves exact process ownership through proxy failure and cleanup. Full gates are green; controller coverage rises by 0.82 function points and 0.80 line points; the fresh P0/P1 review is READY. It depends on #370. Exact-head desktop packaging passed, while the supported stable installer stopped before mutation because no valid signing identity exists. A formal review request is attached to the PR.