assistant: pre-activation hardening follow-ups (2026-06-26 security re-review)

[nedda76]

🔗 Част от launch-gate чеклиста #83.

Non-blocking hardening from the 2026-06-26 security re-review of #80 (ydimitrof / lyubomir-bozhinov). None block merge; all are pre-activation (alongside #134/#135). The CSRF→DoW, prose-gate double-encoding, and non-integer-LIMIT items from the same review are already fixed on the branch.

• Fail-closed limiter keys off a build-time flag. workers/app.ts passes import.meta.env.PROD (resolved at build time) to the limiters → rate-limit.ts failClosed && isProd. A preview/staging artifact built in dev mode has isProd=false, so the paid-endpoint limiter fails open if a key is ever present there. Fix: derive „prod" from a runtime signal (env var / presence of the prod key). Cross-cutting — affects all limiters.
• # comment text-model divergence. sql-guard.ts stripComments strips -- / /* */ but not #; the cheap structural guard's text model then differs from the executor's. Non-exploitable today (the AST layer fails closed on the resulting parse), but worth stripping/rejecting # so the layers agree.
• eop_fetch egress hardening. eop-fetch.ts / tools.ts: add redirect: 'manual' + a fetch timeout + the request abort signal, and a per-turn call budget for eop_fetch / semantic_search (analogous to the rows-read budget), to bound repeated outbound calls.

Refs: PR #80 · docs/spec/ai-assistant.md §7 / §9.4.