fix: redact client-env load failures

[andrei-hasna]

Summary

• stop interpolating raw EMAILS_CLIENT_ENV_SECRET input into vault-load failures
• preserve actionable field, vault source, safe exit status/error code, and missing-key diagnostics
• cover human and JSON stderr with synthetic sentinels and preserve ordinary nonsecret diagnostics
• make the verification-code refusal test inspect the refusal message rather than task-ID-bearing stack paths

Verification

• bun test src/lib/client-env.test.ts — 14 pass, 0 fail
• bun test src/cli/output-safety.test.ts — 5 pass, 0 fail
• bun test src/mode-axis-ratchet.test.ts — 5 pass, 0 fail
• bun test — 4324 pass, 0 fail (4480 tests across 289 files)
• bun run build — exit 0
• bun run test:selfhost-sdk-types — exit 0
• bun run secrets:staged — exit 0
• git diff --cached --check — exit 0

References

• OPE105-00301
• Incident 682089

This PR intentionally does not merge, publish, deploy, or install anything.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #209 @ 1228b89 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at 34721360404500879e48dfc5e01326db7987a3c2.

What I read:

• git log --oneline origin/main..HEAD
• git diff origin/main...HEAD --stat
• the full diff for all four changed files
• surrounding implementation and call paths in src/lib/client-env.ts, src/lib/mode.ts, src/db/self-hosted-store.ts, src/cli/index.tsx, and src/cli/utils.ts
• surrounding affected tests in src/lib/client-env.test.ts, src/cli/output-safety.test.ts, and src/lib/verification-code.test.ts
• package.json scripts and the PR metadata

What I ran:

• bun install — exit code 0. Setup only, not a test gate. Output included 324 packages installed and BUN_INSTALL_EXIT=0.
• bun run test — exit code 0. Output included 4324 pass, 156 skip, 0 fail, Ran 4480 tests across 289 files, and BUN_RUN_TEST_EXIT=0.
• git diff --check origin/main...HEAD — exit code 0.

This repository declares no typecheck script, so no typecheck gate was invented or run.

Blocking P0/P1 findings: none. The changed loader no longer interpolates the raw EMAILS_CLIENT_ENV_SECRET input into reachable spawn, nonzero-exit, or incomplete-entry error paths. It retains only a validated process error code, numeric/unknown child status, and non-secret required setting names. Both human and structured JSON CLI stderr paths are exercised with synthetic sentinels, and ordinary non-secret configuration diagnostics remain descriptive.

Non-blocking follow-ups: none.