[Security] Parse recipe booleans strictly

[fettpl]

Summary

Decodes trust_remote_code and enable_auto_tool_choice as strict optional JSON booleans. Explicit false is preserved, defaults apply only when a field is omitted, and malformed values fail before recipe persistence.

Closes #224

Dependency

Depends on #244. The branch is stacked on its release-gating repair so the repository's current quality gate remains green.

Root cause

Recipe parsing used JavaScript truthiness for security- and behavior-sensitive flags. Values such as the string "false" became true, and the coercion erased the original invalid type before the final recipe schema could reject it.

Solution design

• Decode both fields with one Effect Schema helper for Schema.optional(Schema.Boolean).
• Return real booleans unchanged and apply the existing default only to undefined.
• Reject every other defined value with a stable, field-specific error.
• Exercise the real route and storage boundary to prove malformed requests fail before persistence.
• Keep the existing default trust policy and avoid permissive string or numeric coercion.

Acceptance criteria

• Explicit JSON true and false remain unchanged for both fields.
• Omitted fields retain their release-2.0-compatible defaults.
• Nulls, strings, numbers, arrays, and objects are rejected with stable field-specific errors.
• Invalid API submissions return 400 before persistence.
• Valid explicit-false values persist and round-trip as false.
• Truthiness coercion is removed from the affected serializer path.

Validation

• Reviewed and published exact head: 74b9e5146cfe44f76323b45d6079f3a84477d97b.
• Focused serializer and route suite: 7 tests, 66 assertions, 0 failures.
• Focused coverage: recipe-serializer.ts 90.00% functions / 92.21% lines; recipe-routes.ts 57.14% functions / 46.77% lines.
• npm run check: passed on the exact reviewed head.
• Normal pre-push hook: frontend lint, type checks, cycle/UI-structure checks, dead-code/duplicate/dependency checks, and production build passed again during publication.
• Independent P0/P1 review: approved with no findings.
• Production desktop distribution, canonical reinstall, strict deep signature verification, and live /api/desktop-health HTTP 200: passed for the exact stacked branch.

Current main does not define npm run test:integration or a generic npm --prefix frontend run test script, so those unavailable commands are not represented as passing.

UI changes

None. This change has no visual or interaction impact.

Risks and rollout

• The change is intentionally fail-closed. A manually corrupted or externally written legacy recipe containing a non-boolean value now fails instead of being silently coerced.
• Canonical stored booleans and omitted-field defaults are unchanged.
• Merge [CI/CD] Gate every release on the exact commit that passed CI #244 first, then refresh this branch onto main if GitHub does not remove the stacked prerequisite automatically.

[fettpl]

@0xSero This ready/non-draft fork PR now points to independently reviewed exact head 74b9e51. Its focused tests, full repository check, intact pre-push quality/build hook, production desktop packaging, installed signature, and live health validation passed. Current-head workflows are waiting at GitHub’s fork approval gate: CI run 29731322982 and Security run 29731322859. Please approve these runs when convenient.