fix(security): resolve 17 CodeQL alerts across 6 rule categories

[POWERFULMOVES]

Summary

Resolves all 17 open CodeQL alerts on the hardened branch, organized by rule category:

• B1: Stack trace exposure (6 alerts) — Remove except Exception as e references from HTTP response scopes; use exc_info=True for structured server-side logging; add from None to break exception chains in FastAPI handlers
• B2: Path injection (2 alerts) — Add resolve().relative_to() validation in _safe_model_path to satisfy CodeQL taint tracking through function boundaries
• B3: URL substring sanitization (4 alerts) — Replace startswith("http") with urlparse().scheme validation; add scheme guard before hostname comparison
• B4: ReDoS (1 alert) — Replace overlapping regex [a-z]+b with simple literal pattern in test file
• B5: Missing workflow permissions (3 alerts) — Add top-level permissions: blocks to workflow files (CodeQL requires workflow-level, not just job-level declarations)
• B6: Weak hashing (1 alert) — Replace HMAC-SHA256 kid derivation with BLAKE2b keyed hash (kid is a non-security identifier tag, not password storage)

Files Changed (11)

Category	Files
Stack trace	consciousness-service/main.py, gpu-orchestrator/main.py, tokenism-simulator/api/simulation.py
Path injection	hf-mcp-server/main.py
URL sanitization	credential_setup.py, migrate_tensorzero.py
ReDoS	test_security_fixes.py
Workflow permissions	env-preflight.yml, sql-policy-lint.yml, sync-secrets-local.yml
Weak hashing	geometry_decoder.py

Test plan

• CodeQL Advanced workflow passes with 0 open alerts
• CHIT Contract Check passes
• Python syntax validation: all 8 modified .py files parse successfully
• YAML validation: all 3 workflow files have top-level permissions: blocks
• Existing tests in test_security_fixes.py still pass with simplified regex
• BLAKE2b kid generation produces consistent 16-char hex identifiers

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/codeql-17-alerts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}