fix(bake): close the gaps an audit found in build-box sanitization

[vsilent]

Follow-up to 27017fa. An adversarial review of that change found the sanitize step could destroy the build box, refuse healthy deploys, or report success over an image it had not actually checked.

Volume reset was enumerating every volume on the host, not the project's. On a real build box that removes the ingress' certificates and the agent's state, and aborts the bake on the first volume still held by a running container. Scoped to the project's own compose and matched through Compose's own label; keep entries are validated and matched on whole segments.

The required-key list was read from the text of the compose file, so ${VAR:-default} and $$-escaped text counted as required and no buyer could ever satisfy them. It now comes from the contract — the only thing that has a source on a buyer's machine. References the contract does not cover are resolved back to their literals before the snapshot, since a buyer's env file is replaced wholesale and would leave them empty.

Further:

• config_contract is now the only authority on what is sensitive; the weaker name heuristic is gone. A credential embedded inside a larger value (a password inside a DSN) is cleared in .env as well as in compose.
• The author's own access no longer survives: authorized_keys, private keys, known_hosts and registry credentials are removed alongside the machine identity. Cloud-init appends the buyer's key rather than replacing the file, so a key left behind would grant root on every server cloned from the image.
• The tear-down runs before the rewrites, so a cleared .env cannot fail docker compose down with the files already modified.
• Files are written in chunks, so a large compose no longer exceeds the argument-length limit mid-sanitize; error messages no longer echo the payload.
• A failure reports which steps completed and whether a retry against the same box is still equivalent.
• The bake refuses when no contract resolved, when a compose reads values through env_file: that a buyer would silently lose, on an unknown argument, and when the contract describes a different version.
• Value-stripping no longer clears the field policies inside config_contract itself.

Adds scripts/check-staged-secrets.sh, wired as a pre-commit check — the scanner already configured in .pre-commit-config.yaml was never installed, so nothing was checking. Adds docs/SECRET_LIFECYCLE.md, tracing where one value lives at each stage and which component owns it.

2083 unit tests and 329 BDD scenarios green.

[gitguardian]

⚠️ GitGuardian has uncovered 6 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
37456823	Triggered	Generic Password	27017fa	src/helpers/bake_finalize.rs	View secret
37449298	Triggered	Generic Password	4b1e286	src/cli/generator/compose.rs	View secret
37449299	Triggered	Generic High Entropy Secret	4b1e286	src/cli/generator/compose.rs	View secret
37456824	Triggered	Generic High Entropy Secret	13a65d3	src/cli/generator/compose.rs	View secret
37490585	Triggered	Generic High Entropy Secret	07828d0	src/cli/generator/compose.rs	View secret
37490586	Triggered	Generic Password	07828d0	src/cli/generator/compose.rs	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}