Keep this host's paths and keys out of room lines - #2700

Written-by: Dev

Fixes #2699
Owner: Dev
Reviewer: Reviewer

What changed

A room line is fanned out to every other home in the room (room-membership.js fanoutRoomLine), so it may not carry this machine's private details.

• An unread picture in a group names the attachment, never a path. imagesForGroup used to hand attachmentFilePath(...) to imagePlaceholder, so the far side read The file is at "/tmp/…/attachments/v1/objects/ab/…"; your own file tools can open it. The group form (group: true) now drops the path even when one is passed in: it identifies the picture by file name (or sha256: prefix), media type and size, and says it could not be read. A Bot's own chat keeps the path, because that reader is this home's model and its own file tools can open it (Chat images cannot be read: the host has no vision model, and the placeholder hides where the bytes are #779).
• A crashed external Bot reports only how it ended. The line reads crashed (exit 1) or crashed (signal SIGKILL); the child's last ~200 characters of stderr go to rt.warn. Before, crashed (exit 1: Error: ENOENT: … open '/data/dsh/bot/home/state.json' token=ghp_…) handed the room this host's folders and whatever the child had printed. A spawn or stdin failure reports the crash without the reason too.
• One redaction entry for every room line. The store gate both writers already pass (room-context.js prepareRoomLine, from groups.js appendRoom and room-membership.js append) now also runs this host's rt.redactSecrets before a line is kept or sent. It is wired once at install (setRoomLineRedactor), so no line builder has to remember.
• #1164/#2634 semantics are unchanged: exit/close still race with the first one winning, entry.reported still reports once, and a user stop still writes no crashed line.

Verification at the tip

Tip SHA: ba4f8ce

Ran:

• cd core && TZ=UTC node --import ./test/harness-resolve.mjs --test test/room-line-leak.test.js test/images.test.js test/room-external.test.js test/session-identity.test.js test/room-context.test.js test/room-membership.test.js test/remote-room.test.js test/group-work.test.js → 224 pass, 0 fail
• cd core && TZ=UTC node --import ./test/harness-resolve.mjs --test test/private-files.test.js test/store.test.js test/room-context.test.js test/room-line-leak.test.js → 54 pass, 0 fail
• cd core && TZ=UTC node --import ./test/harness-resolve.mjs --test test/{agents,archive-bot,authz,automation-default}.test.js one at a time → 16/6/21/14 pass (they aborted under full-suite concurrency, not from this change)
• node scripts/ds-bot-patches.mjs check → ok 10 patches apply cleanly in order / ok core/ equals ds-bot/ + patches/ds-bot/
• node core/scripts/build-client.mjs --check → exit 0
• cd core && node dev/harness/node_modules/oxlint/bin/oxlint -c .oxlintrc.json index.js web-search.js src dev scripts test → 0 errors, 87 warnings (all pre-existing)
• node .github/scripts/changelog.mjs check → 35 fragments well formed; node .github/scripts/check-mojibake.mjs --check → 0 occurrences; node .github/scripts/testing-layers.mjs --check → every test file classified

Not run (and why):

• npm run verify (the whole suite) — the brief for this task says not to run it, and this machine has no git
• node scripts/ds-bot-patches.mjs canonical and core/scripts/check-arch-docs.mjs — both need git, which this machine does not have; patches/ds-bot/ was rebuilt by hand (only added lines inside existing hunks, counts recounted) and proven with check's git-free applier, and docs/subsystems/core-host.md (the page that owns core/src/host/) is updated in this diff
• the smoke test — needs a DSH checkout and a bench; nothing here touches index.js or the browser side

Red first: core/test/room-line-leak.test.js (4 cases, full-stack fixture with a remote seat and parseRoomShare over the wire bytes) failed 4/4 against the base implementation — the group line carried /tmp/…/attachments/v1/objects/ab/… and the crash line carried open '/data/dsh/bot/home/state.json' token=ghp_FAKE….

Checkpoint

{
  "pr": 2700,
  "claim": "Dev",
  "issue": 2699,
  "summary": "A room line is sent to every other home in the room, so it no longer carries this machine's private details. An unread picture in a group is named by file name, media type and size instead of an absolute path, while a Bot's own chat still names the path. A crashed external Bot's line reports only exit <code> or signal <name>, and the child's stderr tail stays in this host's log. Every stored room line also passes this host's secret redaction before it is kept or sent.",
  "files": ["core/src/host/images.js", "core/src/host/room-participant-external.js", "core/src/host/room-context.js", "core/src/host/groups.js", "core/src/host/room-membership.js", "core/test/room-line-leak.test.js", "core/test/images.test.js", "core/test/session-identity.test.js", "patches/ds-bot/0001-core-fixes.patch", "patches/ds-bot/0012-room-membership.patch", "docs/subsystems/core-host.md", "changelog.d/2699-room-line-leak.fixed.md"],
  "checks": { "ran": "node scripts/ds-bot-patches.mjs check; 12 core test files; oxlint; build-client --check", "result": "green", "at": "ba4f8ce1829ee4da7e30e6e62507e3106745e2bb" },
  "next": "none — ready for review"
}