fix: hardening batch from adversarial code review (v3.7.6)

[CryptoJones]

Summary

A hardening batch addressing findings from a full adversarial code review of the vault store, mesh replication, guard/enforcement layer, provisioning, and CLI/cron paths. All fixes — no API breaks. NoteFields gains backward-compatible frontmatter/lead fields. Version bumped 3.7.5 → 3.7.6 (patch, per SemVer discipline) with a CHANGELOG entry.

Highlights

• Data integrity: parse/render (and the mesh merge) preserve YAML frontmatter + lead prose and are code-fence-aware; equal-rev merge conflicts converge symmetrically; case-insensitive reserved-name check; dot-prefixed/over-long titles raise clean errors; create_note concurrent-create race closed; atomic writes fsync the directory.
• One bad byte no longer downs the vault: all note/index/log reads decode with errors="replace" (+ BOM strip); search/backlinks skip a note deleted mid-scan.
• Guard false-positives: freshness accepts git -C <repo> fetch and compound read forms; forge/destructive rules are command-anchored; a bare > (pytest 2>&1) is no longer a "side effect"; global-config paths resolve against $HOME so a project-local .claude/ isn't gated; negation-aware auth detection.
• Guard crash-hardening: a learned rule that fails to compile or matches the empty string is rejected at load and skipped at match, so one bad rule can't brick every tool call; command-position anchor covers shell wrappers + sudoedit.
• Enforcement fail-open holes: adapter fails closed on unparseable events and reads array args; contentless list-notes/graph-* no longer clears the gate; secret-output guard no longer leaks pass show X 2>/dev/null | head nor false-blocks pass inside a word; turn-reset clears pending/freshness.
• Availability: atomic config/hook/backup writes; checkpoint never raises into the timer + absolute ExecStart; mesh gitignores .obsidian/workspace.json, doctor surfaces per-peer sync errors, a push timeout no longer aborts the whole pass; OMIND_NO_UPDATE_CHECK no longer breaks explicit self-update; lint --strict passes on a healthy vault; the migrate hook migrates before deleting (no fuzzy/slug-less data loss).

Test plan

• pytest — 714 passed, 1 skipped (the skip is the platform-gated bash+jq secret-guard suite).
• ruff check . — clean.
• mypy src — clean.
• Version lockstep verified: pyproject.toml = __init__.py = uv.lock = 3.7.6; uv lock --check resolves.
• ~350 lines of new regression tests across 12 test files covering each fix class (frontmatter/fence round-trip, merge convergence, guard anchoring/freshness/crash-hardening, adapter fail-closed, secret-guard leak, lint false-positives, compliance torn-line, etc.).

🤖 Generated with Claude Code

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/