feat(ai): hold auto-applied repairs to the previous version's hosts (+ scan specs) - #663

)

Specs filed from the daily security scans, and the fix for the one still
open.

## What changed

- **U1 (low)**:
`specs/done/2026/10/2026-10-26-02-ai-repair-hold-skips-param-only-secrets.md`.
Every scheduled run of a `repair: auto` version is now held to its
granted hosts, whether its credentials sit in `secrets` or come from a
`${param:…}` / `${env:…}` reference. Before, a check with no `secrets`
value ran unheld with the resolved value. Tests cover the checker, the
worker claim path and the agent path, each with a positive control. Docs
updated. Batch gate green (`make build-backend lint-back test`).

## Decided by autopilot

- Nothing: the spec had no open questions.

## Earlier scan specs (implemented, in `specs/done/2026/10/`)


- **S1 (medium)**:
`2026-10-25-01-ai-repair-grant-dropped-by-reference-resolution.md`. The
repair grant was compared after `${…}` references were resolved. Fixed
in #678; see U1 for a remaining gap.
- **R1 (medium)**:
`2026-10-24-01-ai-repair-auto-apply-partial-runtime-host.md`. `repair:
auto` applied a candidate that kept a literal host and added one built
at runtime. Fixed in #663.
- **Q1 (medium)**:
`2026-10-23-02-ai-loop-secret-relay-through-model.md`. AI loops relayed
an encoded secret through the model.
- **P1 (medium)**:
`2026-10-22-01-ai-script-secret-host-guard-runtime.md`. AI runs with
real secrets were only host-checked by regex.
- **K1 (medium)**: `2026-10-20-01-sender-response-body-caps.md`.
Notification senders and RabbitMQ read responses uncapped.
- **J1 (medium)**: `2026-10-19-01-a2a-response-size-cap.md`. A2A
responses were read uncapped.
- **I1 (low)**: `2026-10-18-01-plugin-schema-file-ref.md`. Plugin schema
`$ref` could load local files.
- **G1/G2 (low)**: `2026-10-17-01-postgres-check-connection-config.md`.
Postgres conninfo escaping and fallback to the worker's `PG*` env.
- **F1**: `2026-10-16-15-pat-cache-revocation.md`. The PAT cache
outlived revocation.
- **E1**: `2026-10-16-14-totp-on-federated-sign-in.md`. No TOTP on
federated sign-in.
- **E2**: `2026-10-16-13-atomic-auth-attempt-counters.md`. Auth attempt
counters were not atomic.
- **H3**: `2026-10-16-12-mcp-tokens-rejected-on-rest.md`. MCP OAuth
tokens worked on REST.
- **H2**: `2026-10-16-11-slack-signature-fail-closed.md`. Slack
signature check failed open.
- **T1 / M2 (high)**: `2026-10-16-10-discovery-scans-egress-guard.md`.
Discovery scans were outside the egress policy.
- **N4**: `2026-10-16-09-js-check-nested-docker-guard.md`. A JS `docker`
sub-check bypassed the gate.
- **N3 (high)**: `2026-10-16-08-status-page-components-cross-org.md`.
Status-page components could be edited across orgs.
- **D2/D3 (high)**:
`2026-10-16-07-guard-status-subscriber-and-publication-webhooks.md`.
Subscriber and publication webhooks were not guarded.
- **C3**: `2026-10-16-06-accept-invite-existing-account.md`. Accepting
an invite logged in as an existing account.
- **C1**: `2026-10-16-05-kubeconfig-exec-and-incluster.md`. Kubeconfig
`exec` and `inCluster` were allowed.
- **N2**: `2026-10-16-04-mysql-dsn-injection.md`. MySQL DSN injection.
- **N1**: `2026-10-16-03-env-secret-reference-allowlist.md`. No
allowlist for `${env:}` references.
- **C2/H1**: `2026-10-16-02-token-purpose-separation.md`. Purpose tokens
were accepted as access tokens.
- **D1**: `2026-10-16-01-microsoft-signin-unverified-email-linking.md`.
Microsoft nOAuth email linking.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>