fix: address verified gadfly P4/#4 findings (audit/budget/persona)

Security (all 3 models — HIGH): audit OnTool persisted raw tool args + results
verbatim for the very tools the OnStep narration-redaction flags as secret
(mcp_call/email_send/http_*) — the args/results are what CARRY the secret, so
they landed in skill_run_logs unredacted. Factored the predicate into
isSecretTool() (single source of truth) and OnTool now emits
args_redacted/result_redacted (+ lengths) for secret tools. Test asserts no
secret reaches the log. (persona) webhook_ip_allowlist entries are now
CIDR/IP-validated at load (malformed dropped + warned) instead of accepted raw.

Contract correctness (glm-5.2 + deepseek) — audit Memory now honors its
documented Storage contract: ListChildrenByParent/ListFinishedRunsBefore return
oldest-first; WalkParentChain returns root-first and honors MaxParentChainDepth;
ListRunsFiltered clamps limit (<=0 or >500 -> 50); ListFinishedRunsBefore with
limit<=0 returns none; an explicit RunFilter.Status (incl. "dry_run") matches
regardless of IncludeDryRun; LastRunBySkills counts only status=="ok" unless
includeFailed. (PurgeOlderThan's FinishedAt key is the SAFE behavior — in-flight
runs retained — so the doc was aligned to it, not the impl.)

Error-handling: appendLog now uses a bounded context (auditAppendTimeout=3s) so
a hung backend can't block the run goroutine on the hot path; Sink.StartRun
logs its (still best-effort) failure instead of swallowing it; budget Memory.Get
uses RLock (RWMutex); budget package doc fixed (was skillexec's); Check uses the
budgetWindow constant, not a duplicated literal.

Triaged false-positive: NewNoOpBudget returning BudgetTracker is assignable to
run.Budget (identical method sets) — no change needed.

Core go.sum still free of host/DB deps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

budget/budget.go

@@ -1,4 +1,6 @@
-// Package skillexec runs saved Skill definitions via majordomo's agent
+// Package budget gates and meters per-caller resource use over a rolling
+// 7-day window (run.Ports.Budget). DBBudget is the durable tracker; NoOpBudget
+// disables metering; the BudgetStorage seam backs it (Memory / contrib SQLite).
 // loop (gitea.stevedudenhoeffer.com/steve/majordomo/agent).
 //
 // Why: a Skill is data; the executor turns data into a running agent
@@ -130,7 +132,7 @@ func (b *DBBudget) Check(ctx context.Context, callerID string) error {
 		return fmt.Errorf("budget: %w", err)
 	}
 	if bud != nil {
-		if b.now().Sub(bud.WindowStart) < 7*24*time.Hour {
+		if b.now().Sub(bud.WindowStart) < budgetWindow {
 			cap := b.weeklyLimit()
 			if cap > 0 && bud.SecondsUsed >= cap {
 				if b.notify != nil {

budget/memory.go

@@ -10,7 +10,7 @@ import (
 // usage held in memory (lost on restart). The default behind DBBudget for a
 // light host or tests; mort uses its GORM Storage, contrib/store adds SQLite.
 type Memory struct {
-	mu   sync.Mutex
+	mu   sync.RWMutex
 	rows map[string]*SkillBudget
 }
 
@@ -22,8 +22,8 @@ var _ BudgetStorage = (*Memory)(nil)
 func (m *Memory) Initialize(context.Context) error { return nil }
 
 func (m *Memory) Get(_ context.Context, userID string) (*SkillBudget, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
+	m.mu.RLock()
+	defer m.mu.RUnlock()
 	r, ok := m.rows[userID]
 	if !ok {
 		return nil, nil