feat(vault-agent): anti-leak hardening — disable core dumps + ptrace

[UnbreakableMJ]

What

On startup the agent now disables core dumps and marks itself non-dumpable (which also blocks ptrace by another same-user process). The agent holds the unwrapped user key and refresh token in memory; this closes two ways that material could escape the process — a crash writing a core file to disk, or a debugger attaching. PRD §12 M7 hardening groundwork.

How

• crates/vault-agent/src/harden.rs — harden_process() wraps [secmem_proc::harden_process()], which lowers RLIMIT_CORE and sets PR_SET_DUMPABLE(0) via the audited rustix syscall layer — so this keeps the agent's #![forbid(unsafe_code)] (no hand-rolled unsafe, mirroring the session-keyring slice's use of pure-Rust linux-keyutils). Best-effort: if a sandbox restricts setrlimit, it logs a warning and the agent keeps running (Priority 1 Stability — a partial-hardening failure must not take the agent down).
• main.rs — called first thing after Args::parse() (so --version/--help still exit cleanly) and before try_resume reloads a key from the keyring, so any in-memory key already lives in a non-dumpable, core-dump-free process. The dep is non-optional, so the headless agent hardens too.

Tests

A Linux test asserts /proc/self/status shows Dumpable: 0 after hardening (conditional: where a sandboxed /proc omits the field, the call just must not panic — PR_SET_DUMPABLE(0) is unprivileged, so the assertion is deterministic where it applies).

Verification

fmt --check, fresh-isolated clippy --all-features -D warnings, cargo test --workspace --all-targets (agent 38/38), cargo deny check (secmem-proc / rustix / anyhow all license-clean), and both headless builds — all green.

Manual runtime check on a normal kernel: grep -E 'Dumpable|Max core' /proc/$(pgrep -n vault-agent)/status /proc/$(pgrep -n vault-agent)/limits → Dumpable: 0 and a 0 core-file limit.

Out of scope (tracked follow-up)

mlock/no-swap (lock key pages so secrets never hit swap) — the other half of the persona's ask; trickier without unsafe and can hit RLIMIT_MEMLOCK. Its own slice.

🤖 Generated with Claude Code