Harden TaskCapsule runtime and release gates

[vtino17]

Summary

Harden TaskCapsule as a production candidate across runtime safety, state durability, child-process isolation, CI, and release integrity.

Runtime and destructive-operation safety

• validate capsule, service, check, repository, and stored-state path components
• reject loaded state that does not match the requested capsule and active repository
• restrict recursive worktree cleanup to the managed TaskCapsule worktree root
• reject working-directory symlinks that escape a capsule worktree
• remove the unused duplicate lock implementation and retain the exclusive per-capsule lock
• fail closed when lifecycle state cannot be persisted
• use synchronized unique temporary files for atomic state replacement
• enforce owner-only modes on Unix state, log, check, and handoff files; document inherited ACL behavior and experimental support on Windows
• canonicalize repository aliases so local repositories have stable IDs on macOS

Service execution correctness

• apply configured static environment values, explicit inherited variables, and dynamic port placeholders
• stop forwarding unrelated parent environment variables to child services
• honor and validate configured service working directories
• close parent service-log descriptors after process startup
• propagate check-log and state-write errors instead of silently continuing

Toolchain and supply chain

• raise the minimum toolchain from Go 1.24 to Go 1.25 after reachable standard-library vulnerabilities were found in Go 1.24.13
• pin GitHub Actions to immutable commits
• add pinned govulncheck, CodeQL, OpenSSF Scorecard, Dependabot, coverage, and macOS/Windows smoke gates
• build five release targets twice and require byte-for-byte identical output
• add CycloneDX SBOM generation and GitHub OIDC artifact attestations
• repair malformed README, changelog, and gitignore content and document the actual trust boundary

Verification evidence

Head SHA: 931be97893a1c3ac5a49be47dca27ef52fd42329

Hosted CI run 30729469691 passed all 11 required jobs:

• formatting and go vet
• unit tests with coverage
• unit race tests
• build
• integration tests
• integration race tests
• reproducible release dry-run and archive verification
• macOS smoke tests and build
• Windows smoke tests and build
• govulncheck
• CodeQL

Local verification with the checksum-verified official Go 1.25.12 Linux arm64 toolchain also passed unit tests, integration tests, go vet, govulncheck, actionlint, shell syntax checks, reproducible five-target release comparison, and generated SHA-256 checksum verification.

The local kernel exposes a ThreadSanitizer VMA layout unsupported by Go's race runtime. Hosted Linux race jobs are the authoritative race evidence for this SHA.

Remaining gates

• substantive independent human review is required before merge
• branch protection requires one approval, last-push approval, resolved conversations, linear history, and all required checks
• OpenSSF Scorecard runs on protected-branch changes and its schedule after merge
• no new production-ready, audited, or certified claim is made by this PR
• no release tag should be created until the protected merge and tag-triggered release path are separately verified

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.