v0.7.86 — Security & correctness hardening

v0.7.86 — Security & correctness hardening (green-CI hotfix over v0.7.85)

Supersedes v0.7.85 with two additional fixes that turned the CI matrix green
on all platforms. Same audit scope as v0.7.85 otherwise: two adversarial audit
sweeps over v0.7.84 (every finding gated behind a 3-vote independent refute
panel) plus a prior deep-verify batch — 84 verifier-confirmed bug fixes
(21 HIGH). Full CI green: macOS/Ubuntu/Windows test+check, clippy, fmt, cargo
audit, secrets scan. 1749 tests passing.

Added in v0.7.86 (vs v0.7.85)

• Windows path-denial gap (security): validate_path relied solely on
  Path::is_absolute(), which is false on Windows for Unix-style rooted paths
  like /etc/passwd — so on Windows, sandbox-less file tools (image_analyze,
  file_read, …) could read rooted host paths. Now denied on every platform
  (is_absolute() || has_root() || leading separator || Windows Prefix),
  with a cross-platform regression test.
• quinn-proto 0.11.14 → 0.11.15 — RUSTSEC-2026-0185 (remote memory
  exhaustion via unbounded out-of-order QUIC stream reassembly; transitive dep).

⚠️ Breaking

• RHP wire PROTOCOL_VERSION 1 → 2. The P2P handshake HMAC now signs a
  length-framed (nonce, node_id, timestamp) payload and the receiver enforces a
  freshness window + seen-nonce cache to reject replays. P2P federation peers
  must all run ≥ 0.7.85 — v1 peers are rejected with VersionMismatch.
  Single-node and non-federation deployments are unaffected.

Security

• SSRF: pre-flight check is no longer bypassable via HTTP redirect — web-fetch
  / browser clients re-validate every redirect hop, and the resolver fails closed
  on DNS-resolution error (was fail-open). WASM net_fetch SSRF parity;
  symlink-safe copy; secret newline-injection guard.
• RHP P2P: replay-proof handshake (above) + pre-auth DoS hardening (bounded
  reads, timeouts, connection cap).
• WASM sandbox: shell_exec scrubs the environment (no leaking provider keys
  / vault / OAuth tokens), runs under a timeout, caps output, and enforces the
  operator's ExecSecurityMode; net_fetch caps the response body.
• Supply-chain: ClawHub slug + CLI skill install name path-traversal guards
  (the CLI one prevented arbitrary writes into e.g. ~/.ssh); native skill.toml
  prompt-injection scan; allowlist exec fails closed on shell metacharacters;
  trust-anchored manifest verification. CLI no longer echoes secrets on entry.

Correctness

• Streaming UTF-8 corruption (Anthropic/OpenAI SSE), html_to_markdown &
  compactor UTF-8 panics, apply_patch (context-after insertion, CRLF
  preservation, move accounting), MCP isError propagation, retry-on-transient,
  loop-guard outcome/backoff wiring, vector-recall dimension handling, empty
  env-var detection.

DoS / resource limits

• doc_ingest infinite loop, leaked SSE poller tasks, unbounded reads in
  file_read/media tools/MCP stdio+SSE/A2A/python-runtime/marketplace/provider
  probes, WebCache + A2A task-store bounds, enforced cost quotas.

A third audit sweep (API auth/IDOR, channels, kernel scheduler/RBAC/workflows)
surfaced further candidate findings still pending verification; those land in a
follow-up release.