feat(doctor): add value-free env key strength diagnostic

[roodboi]

Summary

HACK-1127. hack doctor and hack doctor --json now include a read-only env key check. It reports whether the project env secret key material is acceptable and never shows the key.

Final behavior

• Candidates follow the key resolution order: checkout-local .hack.secret.key, the shared key under the git common dir, and the primary checkout's key (linked worktrees only). When no key file exists, the check classifies HACK_ENV_SECRET_KEY instead.
• Closed codes: env-key-ok, env-key-absent (ok); env-key-weak-permissions, env-key-wrong-owner, env-key-wrong-length, env-key-low-entropy (warn); env-key-symlink, env-key-not-regular, env-key-unreadable, env-key-tracked, env-key-public-path (error).
• Strength: the AES-256-GCM key is SHA-256 of the key text. Generated keys (32 random bytes in base64url, 43 characters) pass. Shorter text is wrong-length. Long but repetitive text (fewer than 8 distinct characters, or an empirical Shannon estimate under 128 bits) is low-entropy.
• Exposure: any mode bits set for group or others gives weak-permissions. A uid that is not the current user gives wrong-owner. The symlink check uses lstat and never follows the link. git ls-files ':(glob)**/.hack.secret.key' finds tracked copies at any depth. Copies under public/, static/, dist/, build/, out/, www/, _site/, .next/ and .output/ are reported.
• Value-free output: subjects are project-relative paths or fixed labels (<git-common-dir>/…, <primary-checkout>/…, $HACK_ENV_SECRET_KEY). A tracked path with characters outside the portable set becomes <unprintable-path>/…. Key bytes and absolute paths are never emitted.
• No automatic fixes. --fix does not act on this check. Each finding suggests the exact command to run from the project root, for example chmod 600 .hack.secret.key, git rm --cached -- <path>, or the rotation steps.
• --json adds an envKey object (status, findings[{code,status,subject,remedy}]) to that check entry.

Dependabot inventory. The new scripts/dependabot-inventory.ts [--repo owner/name] [--json] lists open alerts (package, ecosystem, severity, manifest, fixed-in, sorted by severity). It sends a single paginated gh api --method GET request and writes nothing. Refusals are closed and never echo arguments or gh output. It is documented in docs/README.md → Contributing. No dependencies were bumped.

Validation

• bun test tests/doctor-env-key.test.ts tests/dependabot-inventory.test.ts → 30 pass. Env key tests use temp dirs, an injected uid/env and a stubbed tracked-path lister. One test runs a real version-control init in a temp repo with a null global config and a temp HOME to check the glob pathspec. Inventory tests use a stubbed gh runner.
• bun test on doctor-json, doctor-command, doctor-generated-files, doctor-worktree, cli-reference-docs, tests/integration-ownership.test.ts and tests/agent-plugin-generation.test.ts → 96 pass in total, including the two new files.
• bun run --cwd packages/cli typecheck passes with 0 errors. Root tsc reports no errors in the changed files.
• bun run --cwd packages/cli check → 0 errors (34 existing warnings, none in changed files). ultracite check on the changed scripts/tests is clean.
• Smoke run: bun index.ts doctor --json against a temp project, with a temp HOME/HACK_HOME and a stub docker on PATH, gave env-key-absent, then weak-permissions + wrong-length for a 0644 short key, then env-key-symlink for a symlinked key. The env key output contained neither the key text nor the temp root.
• Ran the inventory read-only against hack-dance/hack: it listed the 13 open alerts.
• No CLI options or rendered guidance changed, so docs:cli-reference and generate:agent-plugins were not needed.

Negative controls

• A 0644 key reports env-key-weak-permissions with chmod 600 .hack.secret.key (exact-equality assertion).
• A symlinked key reports only env-key-symlink. Its target is deliberately weak, so following the link would have added a strength finding. A dangling symlink is also reported.
• A short key, a whitespace-only key, a repetitive key, invalid UTF-8, a directory at the key path, a foreign uid, tracked copies, a public/ copy and a weak HACK_ENV_SECRET_KEY each produce their own code. Leak assertions confirm the key text and the temp root never appear in the message or the JSON.

Remaining gaps

• Not run on a real multi-user host: the foreign-owner case is simulated by injecting a uid. Linked-worktree shared and primary candidates are covered by fixtures, not by a live linked worktree.
• On non-POSIX platforms (no process.getuid), the permission and owner checks are skipped.
• The existing "generated files" check still reports a tracked root key, and its --fix path is unchanged. The two checks overlap on purpose.
• Hosted CI on this PR has not been checked yet.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}