[agent] local-tree follow-ups from the PR #265 adversarial review (preflight wiring, packing-failure run dir, pack-glue coverage, content scanning, redaction path patterns)

[danielgwilson]

Goal

Deferred findings from the PR #265 pre-merge adversarial review that were judged real but out of scope for the keystone slice. Each is small and independent.

1. Wire homun lab preflight --reachability sandbox-loopback for local-tree labs. Today it rejects local-tree with a route error (the message now names the gap explicitly). The clone route's sandbox-loopback preflight boots the subject without actor spend; local-tree needs the same using the pack/upload/extract path from src/cua-actor-lab.ts. This is the pre-spend install/build/start check operators will want before a paid computer-use session.
2. Orphaned run directory on packing failure. A local-tree packing failure fails the run closed before any sandbox call (correct) but leaves an empty run directory on disk while the envelope reports no run id. Either create the run dir after packing succeeds or clean it up on the failure path.
3. Direct unit coverage for defaultPackLocalTree. The production glue (createLocalTreeArchive + readFile + ArrayBuffer slice + tmp cleanup) is exercised only by the live rung today; deterministic tests inject the packLocalTree hook. One small test against a real tmp fixture closes the gap.
4. Content-based secret scanning of the packed tree (design question). The always-on denylist matches names, not contents; goal.md documents this boundary honestly. A lightweight pre-upload content heuristic (private-key blocks, _authToken=, service-account JSON shapes) that warns or fails closed would catch what name matching cannot. Needs a false-positive story before building.
5. LOCAL_PATH_PATTERNS in src/redaction.ts only covers /Users/, /home/, /tmp/, /var/folders/ prefixes. Local-tree packing errors no longer embed absolute paths at the source, but the narrow pattern list is a repo-wide redaction gap for CI-shaped paths (/var/lib/jenkins/..., /builds/..., /root/...) on every other route that relies on redactText for path scrubbing.

Required proof

Per item: focused tests plus pnpm check and pnpm public-surface:scan. Item 1 additionally needs one live sandbox-loopback preflight receipt against a synthetic fixture tree.

Non-goals

• No shared-world local-tree work (tracked separately).
• No redesign of the denylist model.