Audit remediation: fix all e2e-audit findings + 8 review-caught regressions

[RNT56]

Summary

Full end-to-end remediation of the 17-subsystem adversarial audit. It found 26 confirmed findings (2 HIGH, 0 CRITICAL); all are fixed here, each with a discriminating test. Then a 12-slice adversarial review of the assembled diff caught 8 second-order regressions the tests missed — all fixed. 134 files, ~8k insertions.

Both HIGH findings

• OpenAI/OpenRouter SSE error-swallow — an in-band data:{"error":…} frame (and an EOF-without-[DONE] with no content) was returned as a nil-error empty/partial success, defeating retry/failover. Now surfaces a typed, retryable-vs-terminal *model.APIError like the Anthropic path.
• Skill-name → API tool name — an unvalidated SKILL.md frontmatter name became skill_<name>, so one malformed installed skill 400'd every model call. Now sanitized/validated at load + a Defs() boundary guard + an install-time check.

Confirmed clusters (all fixed w/ tests)

• Silent-failure bugs: scheduler.Submit >1024-task deadlock; swallowed wt.Commit stranding a verified green shard as false-green; resilience.Stream double-paint across a retry; MCP Manager single-flight ctx-poisoning a concurrent peer.
• Dead-as-advertised closed-loop features: trusted-preset Deploy unreachable; chat /apply trust scope mismatch; exp_config_standing never written; experience -class filter; selfimprove.Scope advisory-only → fail-closed execution screen; super MaxFanout cumulative-not-concurrent; -blast-radius wall fence unenforced on the default Linux namespace backend.
• Invariant edges: read-path final-component symlink TOCTOU (→ worktreefs.ReadConfined O_NOFOLLOW); maint.RotateLog overwriting a hash-chained generation (→ lossless, I5); macOS keychain Set leaking the secret on argv; MCP Headers promising secret resolution no code performed (→ {{secret:}}/{{env:}}).
• Perf: vcache O(n²) → memoized side-effect-free hits; graapprove trust rebuild → incremental.
• Code-intel: graph bare-name node collision → full qualified-id migration (NodeID/SplitID/DisplayName + name→qualified resolution); embedder base-URL; model-keyed semantic cache.

8 second-order regressions caught by the assembled-diff review

worktreefs mkdirAllNoFollow I4 escape (attacker-swapped in-worktree symlink — reproduced then closed); graded auto-approval denying everything under default -blast-radius off; repomap PageRank dropping all edges; macOS ConfigDir move orphaning the secrets vault on upgrade; route.Race loser-cancel nondeterminism; chat stdin os.ErrClosed→fatal() on Ctrl-C. (A 9th — hex redaction — was applied then reverted when it proved to mask the log's own hashes and break the verify cache.)

Contract / infra / docs

• make verify now runs golangci-lint (dogfooded gate == CI == CLAUDE.md §4)
• Container-sandbox I4 CI job (NILCORE_SANDBOX_MUST_RUN) — the primary boundary now has regression protection
• -race lane +6 packages; tui-verify widened
• Release checksums + installer verification (fail-closed)
• Hermetic model-free native-loop convergence smoke test
• Doc drift: non-existent nilcore run, vestigial nullclaw gitignore

Verification

make verify (119 pkgs, lint-inclusive) + Linux cross-build + expanded -race lane + a fully-uncached go test -count=1 ./... — all green.

🤖 Generated with Claude Code