feat(audit): complete Paket H hardening pass

[TimInTech]

Summary

Implements Paket H audit hardening with verified low-risk fixes and one intentional defer.

Included

• H1: split broad config load exception handling into debuggable specific cases
• H2: harden run.sh secrets sourcing with ownership/permission checks while keeping safe source behavior
• H3: add Path(...).resolve() defense-in-depth in transcription path handling
• H4: replace production MagicMock fallback with a small null client stub
• H6: make PasteService key delay configurable and wire it through app init/runtime updates
• H7: localize CUDA_VISIBLE_DEVICES override to the OpenAI Whisper call and restore it afterwards
• H8: collapse duplicate default-model source to a single source of truth in config
• H9: verify OpenAI TTS voice allowlist; keep marin and cedar because they are valid in the installed client

Deferred intentionally

• H5 remains open by design: no reproduced bug, no strong red test, and no evidence of a real busy-loop beyond the existing select(..., 1.0) and fd cleanup behavior

Verification

• ./.venv/bin/python -m pytest -q
  • Result: 252 passed, 18 skipped

Notes

• This branch does not adopt the audit suggestion to parse secrets via grep | xargs, because that would break values with spaces or special characters.
• ROADMAP has been updated to reflect the current Paket H status.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4fc62e31e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".