The rebase brought in a bunch of pre-existing breakage on main that
this PR has to clear before CI can pass:

- recv_event_skipping_lag still took Receiver<Event> but the Arc<Event>
  rework left desktop calling it with Receiver<Arc<Event>>; flip the
  helper to Arc<Event> so the only caller compiles.
- librefang-llm-driver and tests/common/mod.rs still built
  CompletionRequest with messages: vec![...] but the Arc<Vec<Message>>
  rework requires Arc::new(vec![...]).
- clippy 1.94 added manual_contains; rewrite EXACT.iter().any(|p| ...)
  as EXACT.contains(&path).
- kernel approval test ignored a Result return value; add let _ = to
  acknowledge the must_use.

These are not part of the security fix proper but the security commit
cannot land until the workspace clippy / build is green again.

…4126)

* fix(security): tighten audit, sandbox, and spawn deniability holes

Bundle of five security fixes that all touch tamper-resistance or
denial-of-wallet boundaries:

- spawn: validate AgentManifest `module` field — reject absolute paths,
  `..` traversal, and Windows drive prefixes so a hostile agent.toml
  cannot smuggle `module = "python:/etc/passwd.py"` and have the host
  Python interpreter exec it under the agent's capabilities. (#3533)
- migrations: v13 / v17 / v18 applied DDL but skipped the
  `INSERT INTO migrations (...)` audit row, so `user_version` and the
  audit trail drifted by three. Add the missing rows and a startup
  consistency check that logs an `error!` on drift. (#3538)
- audit: lock in #4080's fix that drops an in-memory chain push when
  the SQLite INSERT fails, and add a dup-of regression note. (#3497)
- wasm sandbox: charge per-method fuel reservations on `host_call` so
  a guest cannot fan out unlimited `agent_send` / `agent_spawn` /
  `net_fetch` / `shell_exec` calls under a budget meant to cap CPU. The
  default 1 M fuel ceiling now bounds host LLM calls to ~10/run. (#3532)
- middleware: lock the `/a2a/tasks/{id}/status` auth gate with an
  explicit regression test (dup of #3781 fix). (#3473)

* ci: retrigger CI after auto-update merge with GITHUB_TOKEN

* fix(security): address review feedback on PR #4126

- validate_module_string: normalize backslashes before component scan
  (Linux Path::components treated '..\..\etc' as one filename),
  reject NUL/control characters in payload.
- wasm host_call fuel: fail closed if fuel meter is unavailable or
  set_fuel errors instead of silently swallowing — the reservation is
  the only DOW guard.
- migration drift check: surface query errors with error! instead of
  hiding them behind unwrap_or(-1).
- Strengthened tests: backslash-traversal + NUL cases for
  validate_module_string; relative-ordering assertions for fuel cost
  table.

* fix(security): close 3 #3533 module-path bypasses + auto-heal #3538 audit drift

Address review of #4126:

- #3533: the original PR added validate_module_string only to spawn_agent_inner,
  but three other entry points feed manifests into the registry without going
  through it: reload_agent_from_disk (hot-reload), update_manifest (caller-
  supplied manifest update), and the boot loop's SQLite restore path. A
  hostile agent.toml on disk + restart, or a disk-edit + reload, would still
  install module = "python:/etc/passwd.py" into a live agent.

  Centralised the check in `validate_manifest_module_path` and wired it into
  all four call sites. Boot restore logs error! and skips the agent (refusing
  to boot the daemon for one bad manifest would turn a CVE into a DoS); the
  other paths return Err so the caller sees the rejection.

- #3538: the post-merge consistency check only logged error! on drift but
  never repaired it, so any pre-fix prod DB would spam the log on every
  restart forever. Replaced with a backfill that inserts INSERT OR IGNORE
  audit rows for any version <= user_version that's missing, logs a single
  warn! summarising the rescue, and is idempotent on clean DBs.

  New regression test: simulate v13/v17/v18 drift by deleting their audit
  rows after migrate, re-run, assert rows are restored, then re-run a third
  time and assert the row count is unchanged.

* chore: fix incidental rebase breakage on top of #4129 / clippy 1.94

The rebase brought in a bunch of pre-existing breakage on main that
this PR has to clear before CI can pass:

- recv_event_skipping_lag still took Receiver<Event> but the Arc<Event>
  rework left desktop calling it with Receiver<Arc<Event>>; flip the
  helper to Arc<Event> so the only caller compiles.
- librefang-llm-driver and tests/common/mod.rs still built
  CompletionRequest with messages: vec![...] but the Arc<Vec<Message>>
  rework requires Arc::new(vec![...]).
- clippy 1.94 added manual_contains; rewrite EXACT.iter().any(|p| ...)
  as EXACT.contains(&path).
- kernel approval test ignored a Result return value; add let _ = to
  acknowledge the must_use.

These are not part of the security fix proper but the security commit
cannot land until the workspace clippy / build is green again.

* test(security): add e2e regressions for #3533 spawn boundary and #3532 fuel guard

- spawn_agent rejects absolute and '..' traversal module paths at the
  kernel boundary (locks the wiring on top of the pure-fn validate_module_string
  unit tests in librefang-runtime).
- host_call denial-of-wallet guard fires before dispatch when
  remaining fuel < per-method reservation cost.
- approval.rs: incidental cargo fmt fixup pulled in by pre-commit hook.