fix: CodeQL Highs (#107, #88–#106) and prepare GHSA-8hp3 / GHSA-3mgh

[Hmbown]

Summary

CodeQL + GHSA slice only. Does not tag v0.9.8, publish crates/npm/Homebrew, or retag 2acbd5376 / 5ac75add4.

CodeQL #107 (High, clear-text logging) — scripts/catalog_models_dev.py drift printed remote catalog limit values. Those values are now numbers, null, or the constant redacted. Source URLs drop query/fragment. Tokens never reach stdout.

CodeQL #88–#106 (High, cache poisoning via untrusted code) — Read actions/cache-poisoning/poisonable-step and the YAML. The query treats workflow_call checkout-with-ref as an untrusted checkout, and any ref whose name matches *sha* the same way. workflow_dispatch is default-branch cache write.

resolve already proves the requested SHA equals github.sha. Later jobs now checkout the workflow SHA with no ref:. rust-cache keys are runner OS + arch + explicit stable + rust-cache's Cargo.lock / rust-toolchain.toml hash. github.event / github.ref / github.sha / inputs.* are not cache keys. setup-node's implicit npm cache is off on artifact assemble/smoke. Caller source_sha is compared in env only and cannot retarget checkout or caches.

GHSAs — both already patched on main in 208421b9d (first tagged release: v0.9.0). This token cannot read or publish draft advisories (403 on GET and PATCH). Public advisory URLs 404 (consistent with unpublished drafts). Payloads with those verified ranges are prepared; publish is stopped. No invented CVEs. No new exploit PoCs.

Testing

• python3 scripts/catalog_models_dev_test.py (8 tests)
• node .github/scripts/release-workflows.test.js
• cargo fmt --all -- --check (no Rust source in this slice)
• cargo clippy --workspace --all-targets --all-features --locked (no Rust source in this slice)
• cargo test --workspace --all-features --locked (no Rust source in this slice; local codewhale-tui lib build hit a missing C++ cstring header in this VM)

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• Verified TUI behavior manually if UI changes (N/A — scripts + workflows)
• Harvested/co-authored credit uses a GitHub numeric noreply address (no trailers; no bot/tool Co-authored-by)

v098-final harvest

Cherry-pick in order onto the local lane. Do not take tags or publish commits (there are none).

1. ae088b4a49c8869b981fc0ff1b7405a08f027ea4 — catalog redact
2. b379d7ec6ff9acfe522c746218191215240e6cd1 — release cache pin

git fetch origin cursor/codeql-ghsa-0c3f
git cherry-pick ae088b4a49c8869b981fc0ff1b7405a08f027ea4
git cherry-pick b379d7ec6ff9acfe522c746218191215240e6cd1