test(security): OWASP Top 10 security audit + path traversal fix

[gracefullight]

Summary

• Add 51 comprehensive security tests covering OWASP Top 10 categories (A01–A09)
• Fix path traversal vulnerability in WorkspaceManager.deriveKey() — consecutive dots (..) after character substitution could bypass workspace isolation
• Test agent environment isolation ensuring Symphony secrets (LINEAR_API_KEY, LINEAR_WEBHOOK_SECRET) are never leaked to agent subprocesses

Security Findings

CRITICAL

• Path traversal in workspace key derivation — deriveKey("../../etc/passwd") produced ".._.._.._etc_passwd" which still contained .. (FIXED)

HIGH

• No rate limiting on webhook endpoint — DoS vector (documented in tests, requires infrastructure-level mitigation)
• No authentication on /status endpoint — exposes active workspace info to unauthenticated callers

MEDIUM

• No webhook team scoping — webhook events from other teams are processed (team filtering should be added at orchestrator level)
• No webhook replay protection — replayed webhooks with valid signatures would be re-processed

LOW

• No X-Content-Type-Options security header on responses
• No source IP logging for webhook requests (forensic gap)

Test plan

• All 151 tests pass (100 existing + 51 new security tests)
• validate.sh architecture check passes
• Path traversal fix verified: .. sequences collapsed to single .
• Agent env isolation verified: Symphony secrets excluded from subprocess env

🤖 Generated with Claude Code