P0 security batch: true global admin, quota gates on all spending paths, default quota for quota-less users, fix-review author trust + docker/owner attribution, GitHub App setup issuer binding, real cancel kill, wider shell env exclusion

- CODEX_GLOBAL_ADMINS replaces maintainer-derived global admin;
  admin endpoints (quotas, sweep, backup, push dispatch) fail-closed
  403 when unset, with audit on allow and deny.
- continue/followups/messages/retry check both caller and original
  creator quotas (USD + unpriced token cap), 402 on either overrun.
- Quota-less users now get the #86 default quota instead of unlimited;
  init_db backfills and OAuth create/bind/existing-login branches
  INSERT OR IGNORE a default row; explicit NULL row stays unlimited.
  user_quotas added to migration tables.
- /fix-review: untrusted authors rejected before dedup claim, no task;
  trusted tasks force executor=docker, created_by=project owner, owner
  quota gate, prompt is a fixed template plus a 2000-char excerpt.
- GitHub App setup state only issued by global admins, state rows bind
  issued_by (ALTER-compatible for old DBs), callback rejects issuers
  no longer in the admin list without consuming the state.
- Cancel: popen poll checks DB status every second, Docker path runs a
  cancel watchdog that kills by container name, write-back is CAS-guarded
  so late results never overwrite a new status.
- SHELL_ENV_EXCLUDE adds *_TOKEN, *_AUTH*, *_CREDENTIAL*, *API_KEY*;
  comment states the residual risk: same-UID /proc environ remains
  readable, true isolation needs UID separation or hidepid.
- Tests: new cloud/tests/test_p0_security.py (17 cases); old tests
  updated to the new semantics (admin env, default quota, trusted
  fix-review author) without weakening any gate.

host.py

@@ -211,8 +211,15 @@ TRACE_MAX_LINES = 5000
 # XCM_API_KEY 在 local 路可被模型拿到；server 自己的中转调用走
 # 进程 env（env_key），不受 shell 策略影响，所以只排 shell 不影响
 # 模型调用。inherit 保持默认 all（PATH、代理变量等工作流变量不
-# 动）；gh 用文件登录不用 env，故不排 *_TOKEN；四个精确名是当前
-# worker env 里的全部密钥类变量，三条模式兜底将来新增的同类变量。
+# 动）；gh 用文件登录不用 env，故排 *_TOKEN 不破坏 git 流程
+# （单测验证：gh 登录路径不读 token 环境变量，见 test_shell_env）。
+# P0 安全批后新增 *_TOKEN、*_AUTH*、*_CREDENTIAL*、*API_KEY*
+# 四条模式，兜底将来新增的同类变量。
+# 残留风险（必须如实写清，不谎称修完）：这只是 shell 过滤，
+# 不是安全边界——agent 与 server 进程同 UID 时，模型仍可读
+# server 进程的 /proc/<pid>/environ 或其它未过滤变量；真正
+# 隔离需要 UID 分离或 hidepid 的部署变更，不在本批代码里，
+# 部署清单里必须单独列为后续项。
 SHELL_ENV_EXCLUDE = [
     "XCM_API_KEY",
     "CLOUD_DB_PASSWORD",
@@ -221,6 +228,10 @@ SHELL_ENV_EXCLUDE = [
     "*_KEY",
     "*_SECRET",
     "*_PASSWORD",
+    "*_TOKEN",
+    "*_AUTH*",
+    "*_CREDENTIAL*",
+    "*API_KEY*",
 ]