[codex] Harden public model cache handling

[jvogan]

Summary

• Harden model-pack install, uninstall, purge, and maintenance paths against symlink and containment escapes.
• Add focused tests for HF cache symlink escapes, unsafe uninstall records, orphan cleanup, daemon install download gating, and project bundle symlink resaves.
• Strengthen public repository secret/history scanners, add a Gitleaks config, and clarify public docs around performance, privacy, and daemon exposure.

Validation

• swift test --package-path Packages/ValarCore --jobs 1
• swift test --package-path Packages/ValarPersistence --jobs 1
• swift build --package-path apps/ValarCLI --jobs 1
• swift build --package-path apps/ValarDaemon --jobs 1
• bash tools/public_repo_audit.sh --root .
• bash tools/public_repo_secret_scan.sh --root .
• bash tools/public_repo_secret_scan.sh --root . --include-ignored
• bash tools/public_repo_history_scan.sh --root .
• gitleaks detect --source . --config .gitleaks.toml --redact --no-banner

Public-safety notes

• Did not import private-only model families, local operator workflows, private paths, or token material from the local ValarTTS repo.
• Left the pre-existing untracked assets/media/social-preview-text.jpg out of the commit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ee4618128

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce no-network installs when download consent is denied

The new allowDownload == false gate only checks installState == .cached, but cached is computed from required artifacts only. installRouteModel still calls modelInstaller.install(..., mode: .downloadArtifacts), and downloadArtifactsIfNeeded iterates all artifacts (including optional ones), so a model with missing optional cache files can still trigger remote HTTP requests despite explicit download denial. This breaks the consent contract in environments where users expect allowDownload: false to guarantee no outbound fetches.

Useful? React with 👍 / 👎.