Resolve CodeQL 2.26.4 alert churn

[AcoPiper]

Context

CodeQL 2.26.4 changed Rust data-flow alert locations. The previous main scan with 2.26.3 reported 3 Rust results, while the first 2.26.4 scan reported 60 results and produced 56 open alerts. The CodeQL 2.26.4 release notes explicitly state that improved Rust data-flow locations can make existing findings appear as new alerts while old alerts disappear.

Most findings reproduce categories already reviewed in #181, #183, #210, and earlier dismissed alerts. Inline // codeql[...] comments do not suppress Rust alerts under this repository's Default Setup.

Triage

• Dismiss non-secret logging alerts 128, 130, 144-151, 155-159, and 161-171 as false positives.
• Dismiss test-only logging alerts 129 and 131-143 as used in tests.
• Dismiss intentionally gated secret output alerts 152-154 and 160 as wont fix because output is masked by default and exposed only through --enable show-secrets.
• Dismiss alert 174 as a false positive because stepca is a database username, not a password.
• Dismiss alerts 175-177 as used in tests.
• Dismiss cleartext transmission alerts 179-183 as false positives because the reported source is public CA certificate material used to configure TLS, not secret data interpolated into a URL.
• Dismiss database alerts 172-173 as wont fix under the enforced single-host PostgreSQL boundary from Enforce single-host guardrails for step-ca PostgreSQL #210; PostgreSQL stores role passwords as hashes, while this accepted-risk path provisions the role over the local trust boundary.
• Fix alert 178 instead of dismissing it. danger_accept_invalid_certs(true) disables certificate verification and conflicts with the repository certificate-verification policy.

Implementation

Remove the production --insecure path that disables certificate verification. Bootstrap and repair flows must use the existing configured trust or certificate-pin verification path. Update CLI documentation and tests so no supported runtime mode accepts arbitrary certificates.

The compose smoke path is the one place that ran without trust material, so it needs real trust supplied rather than only prose changes: agent.toml.compose gains a [trust] section to fill in from secrets/certs/, and scripts/preflight/extra/agent-scenarios.sh builds the bundle and both pins from those same certificates for its own runs.

Acceptance criteria

• Alert 178 is fixed in code and closes after CodeQL analyzes main.
• The other 55 alerts are dismissed with the reviewed reason and an auditable comment.
• No CodeQL security query is disabled or excluded.
• All quality checks, tests, documentation checks, and relevant preflight checks pass.

[AcoPiper]

Verification summary

• Delivery: COMPLETE — the merged code delivers what the issue asked for. (the auditor's own verdict)
• Extra changes: EXTRA_CHANGES — the merged code also changed things the issue did not ask for. (the auditor's own verdict)
• Defects: NO_DEFECT — the merged pull requests left no defect of their own behind. (the auditor's own verdict)

Delivery decides whether this issue is closed or reopened. Defects widens what the follow-up filing considers. Extra changes gates nothing — it is an observation for a human; the report names what went beyond the issue.

Implementing pull requests, at the merge commits this audit read:

• Remove the insecure TLS override (#983) #984 — 20d4e6e9d3a7fd7893b2a6bbb20a0ff53298b2a4 (the tree the audit read)

The full report — the assessment included verbatim — stays local, at:
~/.agentcoop/runs/aicers/bootroot/verify/OTgz/report.md

Findings this run did not file:

Finding not filed — The supplied evidence could not verify this finding.
Summary (the filing turn's statement):
Independent CI coverage of the compose-script changes is unverified.
Requirement (quotation from the target issue):
All quality checks, tests, documentation checks, and relevant preflight checks pass.
Missing evidence (the filing turn's statement):
A retained scripts/preflight/extra/agent-scenarios.sh happy run log or workflow-based CI execution; the PR body only self-reports the run, and the inspected workflows do not invoke it.

Finding not filed — This is an improvement nobody requested.
Summary (the filing turn's statement):
The public bootroot::run_oneshot signature also drops config_path, an inert breaking API cleanup beyond the issue.
Observed (the filing turn's statement):
src/lib.rs:59