v1.15.1 — Security hardening

Security hardening — 11 vectors, 12/12 tests green

Static audit performed in session 46. Zero new features. Defensive hardening only.

Critical

• C1 — evaluer audit trail: every evaluer execution is now logged with its script
  and return value in operations.jsonl. New --no-evaluer flag blocks the action entirely
  — recommended in production on interfaces with sensitive forms.
• C2 — operations.jsonl permissions: file created with explicit 0o640 mode and diwall
  group ownership via os.open. Prevents world-readable journal entries.

Elevated

• E1 — _prendre_capture(): single entry point for all PNG captures. Secret-masking JS
  is guaranteed to run before every screenshot, with restoration in finally.
• E2 — URL scheme validation: javascript:, file:, data: and any non-HTTP scheme
  are rejected before Playwright launches (exit code 2).
• E3 — Journal URL sanitisation: query string and fragment are stripped before writing
  to operations.jsonl. OAuth tokens and reset codes are never logged.
• E4 — --ignore-tls-errors flag: replaces the hardcoded ignore_https_errors=True.
  TLS validation is now strict by default; the flag is opt-in for LAN/internal PKI targets.

Medium

• M1 — Preflight scope: extended from .md + scenarios/*.json to .py, .sh, .yaml.
• M2 — Fallback journal: /tmp/diwall/ directory created with 0o700, file with 0o600.
• M3 — Secret masking: _MASQUER_SECRETS_JS extended from 1 to 9 selectors
  (autocomplete, name patterns for token, secret, otp, totp).

Low

• F1 — Structural credential check: preflight now detects plaintext values in remplir
  actions via Python JSON parsing — no longer relies on a hardcoded password string.
• F2 — Inline action validation: _valider_actions_vault() runs on charger_actions()
  and on the --action inline path. A vault_cle field without depuis_vault raises an
  error before Playwright launches.