fix: harden local service boundaries

[charlieijk]

Summary

• bound local GUI resource use and proxy surface
• harden runtime and checkpoint file handling
• add focused regression coverage

Verification

• cargo fmt --check
• cargo clippy --all-targets --locked -- -D warnings
• cargo test --locked
• node --test web/tests/assets.test.mjs
• Python unittest discovery for tests_python
• cargo run --locked -- gui --check

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 139314ac-e816-4b8f-8332-198ca918caf8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}