Track DeepSec findings from the August 31 Codex scan

[chaliy]

Track the findings from DeepSec 2.3.8, Codex gpt-5.5/xhigh, run 20260831222849-464af3390fe5012c (2026-08-31). The scan analyzed 44 candidate files; Rust matcher coverage was low. Severity labels below are scanner assessments, pending individual validation.

Rechecked against ab04bca2 on 2026-09-05. Work begins with the reproducible browser persistence bug. Existing closed security issues cover related earlier work; #1852 is relevant to the release dependency finding.

• Browser persistence: traversal failures overwrite localStorage with partial snapshots (examples/browser/browser-local.js). Preserve the previous snapshot on failure; test unreadable/binary entries and deleted root behavior.
• Anthropic adapter: XML escaping expands content beyond the configured output cap (crates/bashkit-js/anthropic.ts).
• BashTool snapshot constructors discard supplied JS custom builtins (crates/bashkit-js/wrapper.ts).
• CI SQLite fallback installs even when sqlite3 exists due to shell operator precedence (.github/workflows/ci.yml).
• C API release build checks out a mutable tag after validation (.github/workflows/c-api-binaries.yml).
• CLI release build checks out a mutable tag after validation (.github/workflows/cli-binaries.yml).
• JS CI example processes inherit the Doppler token (.github/workflows/js.yml).
• Release examples resolve fresh npm dependencies and inherit secrets (.github/workflows/publish-js.yml); validate against the intent of [DeepSec][HIGH] Release tests install latest npm dependencies before running with API secrets #1852.
• Cargo publish verification builds inherit the registry token (.github/workflows/publish.yml); assess tokenless verification before upload.
• CI grants global checks-write permissions and persists checkout credentials (.github/workflows/ci.yml); assess actual consumers and scope permissions.

Acceptance: confirm each finding against current main, add regression coverage and a focused fix for confirmed bugs, record rejected findings with evidence. Do not treat completion of the scan as revalidation.

[chaliy]

Started on codex/deepsec-fixes, rebased onto ab04bca2.

Browser persistence fix implemented locally: save() now returns false on failed traversal and preserves the previous snapshot. A confirmed missing root still saves an empty snapshot.

Validation:

• Added two regressions before the fix; both failed on the original implementation.
• All 10 browser-local tests pass after the fix.
• Actual @everruns/bashkit-wasm@0.16.0 smoke test: save text, add invalid UTF-8 binary data, reject the next save, reload the original text snapshot intact.
• Knowledge contract checker and git diff --check pass.

Changes remain local, awaiting PR. The other nine findings remain tracked above.