Follow-up: finish the preserved prefix and privacy invariant continuation

[Hmbown]

Closed predecessor: #4632

Preserved snapshot branch: wip/v091-prefix-invariant-continuation-20260721
Exact snapshot tip: 3c35f5644ea962bcd530bab95e765b1b7b355a46

This immutable handoff contains 12 committed privacy/prefix fixes plus a final 36-file WIP snapshot. It covers request prefix stability, compaction checkpoints, fork envelopes, restored publication, sensitive input provenance, exports, resumes, redaction, sink fanout, runtime threads, subagents, tools, and tests.

The original dirty worktree was not altered. This snapshot is intentionally marked WIP and is not release-ready.

How the next model should work

1. Refresh live origin/main, read the current AGENTS.md, and use an isolated worktree.
2. Treat the preserved branch as evidence, not as a merge-ready PR. It has an older base and may overlap later work.
3. Use git log, git range-diff, targeted diffs, and tests to identify behavior still absent from current main.
4. Harvest or reimplement the smallest coherent slices; preserve human attribution and any issue/PR references in commit bodies.
5. Run rustfmt, targeted tests, strict clippy for touched crates, then the required workspace gates. Do not close this issue from prose alone—attach exact SHAs and test receipts.

Do not merge the entire branch blindly, rewrite the preservation branch, or fold unrelated release work into the reconciliation.

Extra safety

• Start with a threat/invariant matrix: stored transcript, provider request, exported thread, forked child, restored checkpoint, artifact/receipt, and debug surfaces.
• Separate prefix-cache byte stability from confidentiality; neither may be “fixed” by weakening the other.
• Never use real secrets in tests.
• Prefer small independently reviewable slices because the branch is large and old-based.

Acceptance

• Sensitive inputs do not fan out to unintended persistence/export/debug surfaces.
• Restores, forks, compaction, and late events retain required provenance without leaking content.
• Provider prefix behavior stays byte-stable where promised.
• Corruption and replay paths fail closed.
• Security-focused tests and current-main workspace gates are attached.