Consume blindfold as a dependency; remove in-tree security code

[mraduldubey]

Summary

• Extracts the credential-security system (auth-socket, credential-store, crypto, shell-escape, OOB collection, token resolver) into the standalone blindfold package and consumes it as a dependency. Fleet no longer maintains the security layer in-tree.
• Moves the egress-confirmation subcommand from apra-fleet secret --confirm to apra-fleet auth --confirm (matching what blindfold's OOB launcher spawns). The old path is removed entirely.
• Hardens test isolation: vitest.config.ts + tests/setup.ts now make it impossible for npm test to write to the real ~/.apra-fleet/data registry (root-caused a load-order bug that had been silently polluting the live registry during test runs).
• Pins blindfold to v0.0.2, which removes the resolve_secure MCP tool. blindfold's MCP wire surface is now vault-only (set/list/update/delete).

What changed under the hood

• blindfold/ added as a git submodule pinned to v0.0.2; package.json pulls it in as "blindfold": "file:./blindfold". Switching to the npm-published version later is a one-line bump.
• New src/services/blindfold-init.ts calls initBlindfold({ dataDir: FLEET_DIR, productName: 'apra-fleet', pipeName: 'apra-fleet-auth' }) at every entrypoint after --version/--help short-circuit. This preserves existing users' on-disk state (~/.apra-fleet/data/credentials.json, the auth socket path, and the Windows named pipe name) - no migration required.
• All ~26 fleet source files + ~11 test files now import security primitives via from 'blindfold'. Fleet-local re-implementations of resolveSecureTokens / redactOutput / resolveSecureField / SECURE_TOKEN_RE are removed in favor of blindfold's canonical exports.
• 9 src files and 7 test files deleted (covered by blindfold/tests/).
• postinstall script in package.json builds the submodule on fresh clones so node_modules/blindfold/dist/ is always present.

Blindfold security hardening (v0.0.2)

The resolve_secure MCP tool that v0.0.1 shipped is a fundamental hole in blindfold's threat model: it took a string containing {{secure.NAME}} tokens and returned the same string with plaintext credentials substituted in - directly to the LLM caller. Even with redaction markers in the response, the plaintext bytes were already in the LLM's context window, transcript, and any upstream logging.

v0.0.2 removes that tool. The blindfold MCP wire surface is now exactly four tools, all vault-management only:

• credential_store_set - OOB collection, returns a handle
• credential_store_list - metadata only
• credential_store_update - metadata only
• credential_store_delete - returns status

Library exports are unchanged (resolveSecureTokens, resolveSecureField, redactOutput, containsSecureTokens, SECURE_TOKEN_RE, SEC_HANDLE_RE). apra-fleet uses those server-side inside execute_command to substitute tokens just before shell exec and redact plaintext from output before returning to the LLM. Plaintext therefore continues to never cross the LLM boundary in apra-fleet workflows.

Implication for standalone blindfold users: blindfold-without-a-host now stores credentials but cannot resolve them in agentic workflows. That is the intended design - vault-only. Hosts (apra-fleet, or anyone consuming the library) own the execution path and the secret-aware redaction. Documented in blindfold's README.md under "Standalone vs host-integrated usage".

Compatibility

• MCP tool surface (credential_store_*, execute_command, etc.): unchanged names, schemas, and response shapes.
• CLI surface: secret --set/--list/--update/--delete unchanged. Only secret --confirm moved to auth --confirm.
• Existing users' credentials, sockets, and pipes: preserved bit-for-bit through initBlindfold configuration.
• blindfold's removed resolve_secure MCP tool: not consumed by apra-fleet (it always used the library function), so zero behavioral impact on apra-fleet.

Test plan

• npm run build (tsc) - clean
• npm test - 1169 passing, 3 failing (all pre-existing baseline: 1 platform.test.ts login-shell env probe, 2 time-utils.test.ts IST timezone). Independently re-verified by reviewer in a separate clone.
• npm run smoke - 13/13 pass with isolated data dir
• npm run build:binary - SEA produces a binary that boots --version in under 400 ms across linux/macos/windows matrix
• CLI round-trip in an isolated APRA_FLEET_DATA_DIR - secret --set / --list / --update / --delete all green
• Test-isolation hardening verified empirically - snapshot-diff of ~/.apra-fleet/data/registry.json across multiple npm test runs returns 0 lines
• Postinstall hook verified - rm node_modules + dist, run npm install, both blindfold/dist and node_modules/blindfold repopulate
• apra-fleet auth --confirm <bad name> rejects with exit 1
• blindfold MCP wire surface inspected via live tools/list JSON-RPC probe - exactly 4 vault tools, no resolve_secure
• blindfold's own test suite: 139 passing, 0 failing
• ASCII-only sprint-wide, no AI / Claude / Anthropic attribution traces

Direct-use testing (NOT done in this PR)

These were deliberately skipped to keep the PR isolated from the reviewer's live MCP setup. Recommended before merge:

1. Point a separate Claude Code session at node /path/to/dist/index.js with a custom APRA_FLEET_DATA_DIR; drive register_member + credential_store_set + execute_command echo {{secure.FOO}} (verify [REDACTED:FOO] in output).
2. Set a credential with network_policy=confirm, run a curl-style execute_command, verify an OOB terminal pops running apra-fleet auth --confirm.
3. provision_vcs_auth for a test repo to exercise the collectOobApiKey path.

Migration to npm (follow-up)

When blindfold publishes to npm:

• Change package.json: "blindfold": "file:./blindfold" -> "blindfold": "^X.Y.Z"
• Optionally drop the submodule