gstack 1.67.1.0

gstack ran an explicit security sweep over all external-contributor code merged since mid-June. No backdoor, no exfiltration path, no live secret leak. Six real findings confirmed and hardened with regression tests. The pre-push secret scanner now catches all-caps database passwords. DSN with an all-caps password at pre-push now blocks at HIGH gate (exit 3). The USER:PASSWORD documentation convention still suppresses, pinned in both directions. Persisted browser sessions stay out of git whether or not repo has a .gitignore. The browse state directory carries a self-contained .gitignore written unconditionally when created. Persisted session-state.json cookies and browse-network.log / browse-audit.jsonl request headers can never be committed. The App Store Connect key is scoped to the one app you are shipping. The exit report tells you it exists and how to revoke it. The App Store Connect upload key minted during Apple release scoped to target app with allAppsVisible:false. The iOS test bridge's Release compile-out is pinned by a free-tier static tripwire. Any regression to a platform-only gate, reordered guard, or dropped define fails CI. The browser server's Node spawn shim regains its exited promise, eager stdout/stderr drain, and 16MB output cap. Correct child-process handling restored on Windows Node fallback. Bearer-token comparison is constant-time. Loopback bearer-token comparison in browse server is constant-time. gstack-egress verify documents that ledger truncation and deletion are out of scope for forensic-observability threat model. New regression guards pin each security property against silent revert. Static tripwire for constant-time validateAuth, table-driven suppression test, unconditional-write test for state-dir ignore, static tripwire for iOS Release compile-out, restored Bun.spawn contract tests.