fix(codeapi): bind issuer trust and sanitize public boundaries

[rschlaefli]

What This Fixes

This PR prepares CodeAPI's existing execution service for another trusted
chat client without adding the Klicker integration itself:

1. Binds JWT verification policy to an exact issuer, including audiences,
   algorithms, key IDs, and accepted principal sources.
2. Corrects the public v1 OpenAPI contract to match the existing execution and
   file routes while keeping the sandbox v2 transport explicitly internal.
3. Removes client-controlled and linkable values from operational logs while
   retaining bounded status, reason, duration, count, and byte evidence.

This is a draft for focused trust-boundary, public-contract, and logging review.

How It Works

• CODEAPI_JWT_TRUST_ENTRIES_JSON defines strict issuer-bound trust entries.
  Legacy issuer, audience, algorithm, and key inputs still normalize to one
  LibreChat-compatible entry when the new variable is absent.
• The verifier uses unverified iss only to select a policy. Signature, key,
  algorithm, audience, source, and time checks run under that selected policy.
• Shared operational-log helpers emit static event names and low-cardinality
  fields across the service and sandbox runtime paths.
• Parsed contract and sentinel-capture tests protect the public API shape and
  reject raw, encoded, hashed, nested, message, and stack representations of
  synthetic client values.

Important Details

• The issuer-bound trust decision is recorded in
  docs/adr/0001-issuer-bound-jwt-trust.md;
  the execution record is in
  docs/project/2026-08-30-pr-18-codeapi-trust-contract-logging-plan.md.
• Modern and legacy trust policy modes are mutually exclusive. Malformed,
  duplicate, missing, orphaned, or algorithm-incompatible key assignments fail
  configuration.
• No dependency, remote JWKS provider, execution behavior, storage model, or
  rate-limit behavior is added or changed.
• The package is one independently functional and reviewable unit. Local
  verification covers all source changes; deployment and live proof remain
  separate.

Branch Coverage

• Base: main@83c4f7b
• Head: a93874e
• Reviewed source: 83c4f7b..0be1654; the three later commits update only the
  committed plan, verification status, and PR metadata.
• Coverage: 10 commits and 60 changed files, including the plan, issuer trust,
  API contract, service-edge logging, runtime logging, tests, ADR, and final
  verification evidence.
• Substantive size: 59 files, +2,738/-924 lines after excluding the committed
  project plan; no lockfile or generated-output delta is present.

Review Focus

• Confirm issuer selection cannot widen trust across configured entries and
  that legacy LibreChat behavior remains equivalent.
• Compare service/openapi.yml with the runtime v1 execution and file routes,
  especially generic errors, timeouts, rate limits, and download behavior.
• Inspect the operational-log field allow-list and sentinel captures for paths
  where arbitrary errors or client values could re-enter logs.
• Confirm the internal /api/v2/execute transport remains separate from the
  public v1 contract.

Verification

Current head:

• git diff --check -> pass at a93874e.
• Staged gitleaks scans for the final plan status and PR metadata updates -> no
  leaks found.

Earlier branch verification:

• API bun test -> pass at source SHA 0be1654.
• API build -> pass at source SHA 0be1654.
• Service bun run test -> 569/569 pass at source SHA 0be1654.
• Service build -> pass at source SHA 0be1654.
• tests/block_root_package_delivery.sh -> pass at source SHA 0be1654.
• tests/sandbox_runner_healthcheck.sh -> pass at source SHA 0be1654.
• Required slice simplification and risk reviews -> no unresolved findings.
• Integrated final review across correctness, plan compliance,
  maintainability, security, and architecture -> no findings.

The verification remains applicable because 0be1654..a93874e changes only
the committed project plan.

Failed/Warning:

• A diagnostic bare bun test in service/ also discovers the k6 stress
  script and fails to resolve k6/http. The repository-defined and CI-aligned
  command is bun run test, which passed 569/569.
• The service build retains existing Rollup export and circular-dependency
  warnings plus two existing TS2352 warnings.

Not run:

• No production issuer, key, deployment, cluster access, or live authentication
  proof was used. Those actions and values are outside this PR's authority and
  scope.

Security / Privacy

• Review: dedicated security/architecture and privacy/security slice reviews,
  followed by the integrated final review.
• Result: no unresolved findings in the reviewed local source range.
• Sensitive data: examples and sentinels are synthetic. No credentials,
  production values, personal data, or execution payloads are included.

Blocking Before Merge

• Exact-head GitHub checks must pass.

Follow-Up After Merge

• Configure approved issuer-bound trust values through the secret store in
  a separate deployment change.
• Prove LibreChat and Klicker authentication plus values-free logs in
  staging under separately approved rollout and live-smoke plans.

Local Session Artifacts

Machine-local pointers for a session resuming this branch, not review evidence.

• Machine: MacBook-Pro.local
• Worktree: trees/codeapi-trust-contract-logging in repository
  code-interpreter
• Review reports: docs/project/_local/reviews/