fix: close the findings of the final pre-release review

[Vonng]

Six independent adversarial reviewers went over everything between RELEASE.2026-08-06T00-00-00Z and bae97f94 (credential redaction, checksum verify, behavior changes, release chain and CI, the module-path sweep, and a black-box differential run against the 0806 binary on a live SILO server). No blocker was found; this PR closes every code finding they did report.

Credential redaction

• Default admin trace printed the raw query string, error, message and annotations of every traced request — a presigned URL's signature, an STS session token, a proxy token= of any client the server traced — in both the text and the JSON rendering. Only the verbose path went through redactTraceText. Both renderings now work on redacted copies of those fields; the shared event is never mutated.
• The verbose path passed the raw query without its leading ?, so the query shape (anchored on [?&]) missed a credential in the first parameter. redactTraceQuery puts the anchor back.
• Three free-text shapes matched ordinary prose and were applied to every error message: AWS S3 compatible → AWS **REDACTED** compatible, token has expired → token **REDACTED** expired, Basic auth is disabled → Basic **REDACTED** is disabled, bufio.Scanner: token too long → token **REDACTED** long. The SigV4 shape now requires its Credential= field, the SigV2 shape the key:signature colon, and the scheme shape a payload that looks like a token rather than the next word of a sentence. Every echoed-credential case the shapes covered is pinned by tests.
• The registry no longer records placeholder values (auth_token=off, client_secret=true) that turned every later off/true into a marker; admin config set now registers and masks credentials embedded in values whose key names none (a DSN password=, a URL's userinfo, a webhook ?token=); an Authorization payload after a doubled space is registered trimmed.
• checksum verify scrubs transport read/close errors before writing them into a record, like server errors.

Behavior

• admin user svcacct set --policy refused an empty document, and an empty document is the only way to clear an inline policy and return the account to its inherited one (the server treats {"Statement":[]} as a reset). The shape is still validated strictly; emptiness is allowed on set.
• A malformed --custom-header, --resolve or --limit-* value was printed twice, the first copy on stdout (the CLI library echoes a Before error to its writer). It is now reported once, on stderr, or as a JSON error document under --json, at both the app and the command level.

Tests and CI

• The functional test asserting that explicit --quiet silences checksum verify could not fail (the harness swallows stdout); it now captures the command's own stdout.
• The Windows CI step runs under bash so a failed go build fails the step (pwsh only propagated the last command's exit code and left %GOPATH% unexpanded).
• A comment in check-release-commit.sh no longer claims exclude_pull_requests filters runs; the event/head_branch filter does.

Verified on the branch: go test ./..., go test -race on the redaction set, make verifiers (vet, golangci-lint, brand, credits, all five release fixture suites), actionlint, shellcheck (no new warnings), and real-binary probes of both flag levels and --json.

Follow-ups from the review of this branch

• checksum verify no longer labels an SSE-C refusal as UNKNOWN_SSEC_KEY_MISSING when a key was supplied (SSE-C over plain HTTP): with a key the server's complaint is about the request, so it is a read error carrying the message. --max-size rejects a bad value with the value and the expected form, and its help says 0 means no limit.
• The strict policy parser answered an empty document with "EOF"; write paths say "policy input cannot be empty" again.
• A percent-encoded URL password in an admin config set value (url=amqp://user:p%40ss@host) is registered and masked as written, not only decoded; quoted DSN payloads are recognized; password=password (the documentation's placeholder) is not registered.
• max-keys, key-marker, continuation-token stay visible in trace output and --debug URLs; the query shape's key/token fragments had blanked them.
• The SigV2 shape requires a base64 signature after the colon and scheme words match in header spelling, so "AWS https://s3.amazonaws.com" and "digest SHA256:..." remain prose.
• docs: an endpoint must report x-amz-checksum-type; otherwise every checksummed object is UNKNOWN_CHECKSUM_TYPE.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VX7dtHJ4q7GJ1YDYeXLmjW