Harden MCP agent integration and tests

[pazureczek]

Summary

This PR hardens OpenPass' MCP/agent integration and test reliability:

• Redacts resolved secret values from MCP run_command / execute_with_secret tool output, including stdout/stderr/error paths.
• Isolates MCP command and HTTP-server tests to reduce shared global/listener flakiness.
• Makes SSH push error tests hermetic and classifies SSH known-hosts/config failures more clearly.
• Pins the Go toolchain through the project config / CI paths used here.
• Adds Hermes/OpenClaw safe-adoption guidance and related docs/dependency metadata updates.
• Hardens tests against ambient OPENPASS_MCP_TOKEN so local make test remains deterministic in developer/agent shells.

Verification

Run locally on WSL with Go 1.26.3:

go version go1.26.3 linux/amd64

Fresh pre-PR checks:

git diff --check upstream/main...HEAD
# passed

go vet ./...
# passed

go test ./cmd ./internal/mcp -race
# passed

make test
# passed; runs go test ./... -race -v

Independent pre-PR review verdict: PASS.

Reviewer notes:

• No blocking security or logic issues found in the diff against upstream/main.
• A synthetic merge-tree check against current upstream/main reported no conflicts.
• Remaining caveat: the local checkout still has a pre-existing untracked OpenPass binary; it is not part of this PR.

Caveats / scope notes

• Secret masking is exact-value masking for resolved secrets. It is defense-in-depth, not full DLP for transformed/encoded/partial secret variants.
• This branch is from rzyns/OpenPass:main to danieljustus/OpenPass:main.

[danieljustus]

Thanks for the contribution! The security fix and test improvements look
solid. Before merging, could you update docs/hermes-safe-adoption.md to
use generic placeholder names instead of 'Janusz'? This is public
project documentation and shouldn't reference a specific person's
personal workflow.

[szponeczek]

Thanks for the contribution! The security fix and test improvements look solid. Before merging, could you update docs/hermes-safe-adoption.md to use generic placeholder names instead of 'Janusz'? This is public project documentation and shouldn't reference a specific person's personal workflow.

Hah, derp... sorry about that! Also got rid of some other me-specific stuff 🤤

[danieljustus]

Thanks for the contribution! The security fix and test improvements look solid. Before merging, could you update docs/hermes-safe-adoption.md to use generic placeholder names instead of 'Janusz'? This is public project documentation and shouldn't reference a specific person's personal workflow.

Hah, derp... sorry about that! Also got rid of some other me-specific stuff 🤤

No worries, happens to the best of us! Thanks for the cleanup and the solid PR overall. Appreciated 🙌