fix(secrets): complete callback and credential ownership

[blakinio]

Purpose

Close audited LOW residual OTC2-POST-001 left by the independent post-remediation closure audit.

Implemented contract

• CallbackAttempt.target is private after bounded accepted construction;
• external safe Rust callers cannot mutate, take or replace the accepted callback target;
• a compile_fail API example proves direct target mutation is unavailable;
• technical-login and identity-security fixtures construct callbacks through CallbackAttempt::new;
• the callback remains bounded, redacted, non-cloneable and explicitly overwritten on terminal drop;
• direct non-empty oversized GameEntryCredential input is filled with zeroes before TooLarge returns;
• accepted credential bytes retain their owned Vec<u8> and existing expiry/one-shot semantics.

Boundaries

Only project-owned initialized bytes are claimed. Allocator, browser, HTTP/TLS, library and operating-system copies remain outside the guarantee. No dependency, manifest, lockfile, workflow, shutdown, asset-open, architecture-policy, endpoint, protocol, shared PR #23 documentation or unrelated UI path remains in the diff.

Exact-head validation

Head 0d6f605a856bc493912ea047d3e782f937ec095f passed:

• Rust Client run 30703733965;
• Windows job 91379117193: locked metadata, rustfmt, strict Clippy, full workspace tests including the compile-fail doctest, and real-workspace architecture validation;
• Supply Chain job 91379117171;
• repository CI run 30703734074;
• CI / Required job 91379221271;
• focused identity, game-session, technical-login integration and identity-security tests during exact fixture migration;
• exact changed-file review: five declared paths only;
• comments, reviews and unresolved review threads: none.

Result

OTC2-POST-001 is closed. Relative to the accepted post-W7 package invariant, OTC2-AUD-001 can now be marked CLOSED while retaining the original best-effort project-owned-memory boundary.

Task

OTC2-20260801-secret-owner-completion