Audit-driven hardening: security fixes, dep hygiene, perf, +75 tests

[nyo16]

Summary

Implements the fix plan derived from a full-codebase health audit, plus a
streaming/tool-call hardening review. One HIGH security finding, several
medium/low fixes, BEAM-level performance work, dependency hygiene, and a large
test-coverage expansion.

Full suite green: 1881 passed (+75 over baseline), 0 failures. mix format

• mix credo --strict clean.

Security

• Fix HIGH approval-gate bypass. In AgentRunner, the pre_tool_use
{:modify, …} hook branch skipped enforce_policy_approval/2, so a tool gated
  only by the permission policy (:strict / approval_required /
  execute-category) executed ungated whenever any hook rewrote its arguments.
  The modify branch now applies policy approval identically to the normal path.
  (+ regression test)
• InputGuard fails closed on dropped strategies. A timed-out/errored strategy
  under the default :any aggregation no longer passes as :safe — it upgrades
  to :suspicious (configurable fail_closed, telemetry + log, new
  strategy_timeout).
• :permissive policy no longer auto-approves execute-class tools.
  category: :execute tools (e.g. bash) keep their approval gate under
  :permissive unless allow_unattended_execute: true (new
  requires_approval?/3).
• SQL identifier-injection primitive removed. field_to_column/1 is now a
  strict column allowlist in the SQLite/DuckDB memory stores.
• mix nous.optimize stops eval’ing --params. Accepts safe YAML/JSON data;
  Code.eval_file is now an explicit, warned .exs fallback only.

Dependencies

• Purge 36 stale mix.lock entries; add mix deps.unlock --check-unused to CI.
• Loosen net_runner (~> 1.0) and req (~> 0.5 or ~> 0.6); make
  phoenix_pubsub optional: true so its constraint reaches downstream.
• Guard the optional hackney crash paths (backend selection + pool config).

Performance (BEAM hot paths)

• Context.add_messages/2: single concat, O(n+m) instead of O(n·m).
• PubSub: memoize Code.ensure_loaded?(Phoenix.PubSub) in :persistent_term
  (was running per broadcast — i.e. per streamed token).
• Hybrid memory search: run the embedding round-trip concurrently with the text
  scan (store access stays single-process — safe for SQL backends).
• SSE parsing: :binary.split instead of a per-chunk regex split.

Tests (+75)

• New coverage: OpenAI request marshalling, InputGuard fail-closed,
  permissions category-gate, optimizer data params, Context.add_messages
  equivalence, output_schema one_of error path, semantic input-guard
  strategy, ParallelExecutor, teams Supervisor, research Planner +
  Synthesizer, and a reusable Nous.MemoryStoreConformance harness (wired to
  ETS; native backends adopt it behind a tag in CI).
• Removed flaky/redundant Process.sleep calls in rate_limiter, workflow
  state, and phase3 tests; fixed the self-contradicting one_of test.

See CHANGELOG.md for the user-facing security entries.

Deferred (intentionally out of scope — each documented)

• Duplicate PubSub delivery (AgentServer): real, but the server subscribes
  to the topic it broadcasts on — a "pick one path" change risks a latent
  self-broadcast loop. Needs a reproduce-first test with real Phoenix.PubSub.
• Native-dep work: llamacpp provider/normalizer tests, native optional-dep
  declarations, and dependency version bumps belong in a CI job where the
  C++/Rust/NIF/XLA builds actually run.
• Low-severity perf tweaks (SharedState reads, checkpoint keying, concurrent
  tool execution, etc.): real tradeoffs; a focused perf session.
• Research Searcher unit tests: web-tool-bound (needs tool mocking).

Notes for reviewers

• mix dialyzer was not run (PLT rebuild); worth running before merge given the
  type-touching changes (agent_runner, permissions, the new policy field).
• Three behavior changes ship with CHANGELOG entries: the approval-bypass fix,
  InputGuard fail-closed default, and the :permissive execute-gate.