Scoped host mounts, warden_addons packaging, 0.4.0 + audit hardening

[d0cd]

Summary

Brings the feat/host-mounts line of work onto main: scoped host mounts, the warden-addons packaging refactor, the 0.4.0 release bump, and remediation from a two-pass security + code-quality audit.

Note on history (single squashed commit): the branch's history was rewritten with git filter-repo to strip an 80 MB benchmark-baseline artifact (and clean up history). That detached it from main's lineage (125 phantom conflicts), so the content was rebuilt on top of current main for a clean, conflict-free, reviewable PR. The tree is byte-identical to the developed work except for re-applying main's dependabot dependency-floor bumps.

Headline changes

Feature — scoped host mounts (mounts:)
Bind-mount an operator-allowlisted host directory into a cell (ro default / rw opt-in), bounded by the VM-level mount_roots allowlist, with realpath re-containment, symlink-escape hardening, and brig cell mount-scan. Adds security invariant 13.

Refactor — warden addons packaged
Moved into the brig package as shipped data (src/brig/warden_addons/), resolvable in editable + wheel installs, synced into the warden container by brig system up (kills the deploy-drift gotcha).

Security & quality hardening (two audits)

• Egress fail-closed: reconciler refuses to reuse a brig-<cell> network that isn't --internal (invariants 1 + 4).
• Secret redaction now covers every sink, including the ctx.log blocked-request path; unified redaction primitive + entropy-based detection.
• Shared brig.ops.locking.locked_file; _atomic_write core; dead-code removal.
• Doc-accuracy fixes (concepts.md gVisor/sanitize corrections, security.md, INVARIANTS, sdk/cli docs).
• Test-assertion strengthening (assertRaises(msg=) → assertRaisesRegex).

Versioning — bump to 0.4.0 (new invariants 11–13, removed brig cell trace).

Dependencies

Preserves main's merged dependabot dep-floor bumps; keeps the corrected mitmproxy>=10.1.1,<11 pin (matches the warden image — >=10.0 is a known-bad loosening). GitHub Actions version bumps will be re-proposed by dependabot against the new main.

Verification

• make test → 1208 passed; ruff + mypy clean; pre-commit hooks pass.
• Local e2e: make smoke 28/0, make redteam (containment) 7/0.
• Merges cleanly into main — 0 conflicts, fast-forwardable.

🤖 Generated with Claude Code