Security Fix Summary

What changed

Added zypheron-ai/utils/secure_files.py with shared helpers for:
- validating session IDs against ^[A-Za-z0-9._-]{1,64}$
- resolving paths inside an expected base directory
- creating private files atomically with 0600
- ensuring private directories with 0700 where supported
Hardened autopent session persistence in zypheron-ai/autopent/session_state.py:
- rejects unsafe session IDs before save, load, delete, autosave, and metadata lookup
- writes session JSON and HMAC sidecars atomically
- creates session.key privately at creation time
Hardened authenticated session storage in zypheron-ai/auth/session_manager.py:
- reuses the shared session ID validation and path resolution logic
- creates sessions.key privately at creation time
- writes encrypted session blobs atomically
Hardened loot handling in zypheron-ai/core/loot.py:
- validates session IDs on construction and metadata lookup
- keeps loot paths contained under the configured loot base
- preserves O_NOFOLLOW protection for final file writes
Removed secret previews from credential display in zypheron-ai/autopent/credential_vault.py:
- display output now uses a redacted form only
- logs and approval prompts no longer surface secret prefixes
Hardened cluster secret creation in zypheron-ai/distributed/network.py:
- cluster.secret is now created privately instead of chmodded after write

Passed:
- ./.venv/bin/python -m pytest --no-cov tests/test_security_remediation.py tests/test_autopent_runtime.py tests/test_scanner_safety.py in zypheron-ai
Partial:
- ./scripts/run_all_tests.sh --ci started successfully and advanced through the API test suite, but the run became long-running and was interrupted before completion