fix: keep credential homes private under trusted ancestry

[batmnnn]

Summary

• Fixes Credential home under a shared parent can be renamed aside before auth use #157: reject non-sticky / untrusted ancestors for the durable Codex Security credential home (same rename class as Scan output under a shared parent can be replaced before completion #109/fix: keep scan output private through completion and exports #118, for auth.json instead of scan output).
• Re-check private leaf + trusted ancestry on prepare and every use path: lock acquire/release, stored-auth probe, logout marker writes, ambient-import destination homes, and CLI login/logout fallbacks.
• Harden auth.json: regular non-symlink file with private POSIX mode/owner before treating stored credentials as present.
• Pin (st_dev, st_ino) for the duration of a credential-home lock session. Durable cross-process pins are deferred (no workbench row for credential homes); every-use re-validation covers the cross-user class.
• Introduces shared requireSecureOutputAncestry / requireTrustedOutputAncestor helpers (compatible with fix: keep scan output private through completion and exports #118) used for credential-home trust; does not change scan-output prepare paths (left to fix: keep scan output private through completion and exports #118).

Test plan

• bun test --timeout 60000 ./tests-ts/runtime.test.ts ./tests-ts/cli-authentication.test.ts
• Posix: reject credential home under non-sticky shared parent
• Posix: accept sticky shared parent owned by self/root
• Posix: reject sticky parent owned by another UID
• Posix: reject leaf that is no longer private after prepare
• Posix: reject replaced credential home (different inode) on lock release
• Posix: reject world-writable or symlink auth.json
• CLI login/status/logout still share one canonical credential home

Made with Cursor

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[mldangelo-oai]

Thank you for working on credential-directory privacy. The protection and a more complete version of the related tests have already landed on main, so merging this older branch would duplicate the fix. I'm going to close it, and we'd welcome another security-focused contribution.