fix(security): enforce stream guards and align runtime contracts

[Destynova2]

Security decisions on streamed responses depended on JSON formatting and transport boundaries. Output DLP could emit configured secrets before detecting them, HIT could miss tool blocks or decide on partial arguments, and cached JWT signatures outlived token expiry. Documentation and image publication also described different runtime behavior.

This change:

• Frames bounded SSE events before security checks, authorizes parallel tools separately, validates complete JSON arguments and checks decoded string values against deny rules. Pending approval applies upstream backpressure.
• Checks each complete text block before output DLP releases it; malformed, incomplete or oversized blocks fail closed. Removes the prose-length bypass and the unbounded full-response buffer.
• Rechecks JWT expiration on cache hits and enforces virtual-key quotas on LLM calls, sharing the key bucket with the credential gateway without charging it twice.
• Replaces the Python documentation checker with Rust tests that invoke syntax-only compilers. Fixes fenced-code extraction, timeout-field assertions and CI selection of the new test modules. Removes the nonexistent Windows download instruction and documents a complete systemd user-service setup.
• Publishes cross-compiled binaries through the same Containerfile runtime stage as local builds. Tests image defaults, writable state and restart before promotion. Adjusts E2E ports and audit ownership; preserves open audit journals during tests.

Validation:

• 1,881 nextest tests passed; 14 documentation-contract checks passed, including the explicitly enabled syntax checks.
• 24 Rust doctests passed (2 existing ignored examples), Clippy with warnings denied, actionlint, shellcheck, Markdown lint and offline links passed.
• Synthetic regression cases cover JSON whitespace/escapes, every transport split, split secrets after prose, anchored regexes, initial text, incomplete and oversized streams, parallel tools, fake stop markers, JWT cache expiration and per-key throttling.
• Locally assembled the prebuilt ARM64 image with the official v0.36.110 binary and verified its default user/port, named-volume writes and restart using synthetic configuration. This verifies packaging; the new Rust code was tested on macOS. CI validates current-source Linux builds and the source/prebuilt container paths.

Behavior to review: when output DLP is enabled, text is delivered at content-block completion rather than token by token. Matching is scoped to each text block; tool input, thinking blocks and matches across separate text blocks are outside that DLP adapter. The 1 MiB/4,096-event limits bound retained data and serialized output, not total process RSS or temporary replacement allocations.

[github-actions]

Mutation testing (PR diff sample)

Informational — never blocks merge. Full matrix runs on main.

Metric	Value
Status	timed-out
Duration	1501 s
Total	55
Caught	8
Missed	0
Timeout	0
Unviable	47

Legend: clean (no survivors), missed (inspect artifact), timed-out (25 min cap reached).

Artifact: mutants-pr-results-7c5b11c44e7060a8946ab3948484711e884be087.