Device identifiers remain in pre-#106 git history (momentum fixtures)

[millsmillsymills]

Context from #106 (which scrubbed the live tree).

The capture device's hardware_uid (3288010126E18000), radio_ble_mac (32880126E180), and hardware_name (Lun10n) were committed in the flat tests/golden/fixtures/cli_exec_device_info.json and unit-test mocks before #106. #106 scrubbed every tracked file and added length-preserving redaction to tests/golden/record.py, so the current tree and all future re-records are clean — but the history of this public repo still contains those values.

Sensitivity is low: none are credentials; the BLE MAC is air-broadcast by the device anyway; worst case is physical-proximity correlation. Options:

1. Leave it — accept the low-sensitivity historical exposure (recommended given the data is already public and air-broadcast).
2. History rewrite — git filter-repo to purge the values, force-push, invalidating existing clones/forks. Heavy, disruptive.

Decide and close. No code change needed for option 1.

[millsmillsymills]

Closing wontfix. History rewrite is poor ROI here:

• The values also live in base64-encoded fixture event payloads (non-byte-aligned inside whole-stream b64), so git filter-repo --replace-text can't touch them — needs a custom blob-callback reproducing test(golden): dual-firmware golden fixtures (Momentum + Official) #106's redaction per historical commit.
• filter-repo strips all signatures → required_signatures rejects the push without re-signing every rewritten commit; non_fast_forward + signature rules on phase1 must be temporarily relaxed and the force-push run by a human.
• Public repo: rewrite changes every downstream SHA and invalidates clones/forks, and GitHub still caches old blobs in commit/PR views until Support manually purges — so the rewrite is incomplete without a support ticket.

Sensitivity is low: none are credentials; the BLE MAC is air-broadcast by the device anyway; hardware_uid is immutable silicon and can't be rotated. The live tree and all future re-records are scrubbed (#106 added length-preserving redaction to record.py). Accepting the historical exposure.