fix(security): close INFO ASVS findings — secret echo, TLS floor, mandatory tarball SHA, CORS/Content-Type guards, BUG-17

- V7.1.3: env known-insecure-default error no longer echoes the rejected secret value.
- V9.1.4: syslog-over-TLS forwarder + listener pin minimum_version=TLSv1_2.
- V12.1.2: updater tarball SHA-256 verification is now mandatory and fail-closed —
  /update and /update-self reject a missing digest (400), the executor rejects
  missing/mismatched digests before extract/apply. Every push path supplies it.
- V13.1.4: reject a wildcard '*' in DECNET_CORS_ORIGINS at startup.
- V13.1.5: enforce application/json on JSON write endpoints (415 otherwise),
  exempting multipart upload routes.
- BUG-17: SSE error log records the user uuid, not the resume cursor.

Also completes V2.1.7 consistently: the attacker-injectable PYTEST* env bypass is
replaced with explicit DECNET_TESTING=1 in the three remaining sites
(env.validate_public_binding, config logging, mysql url builder).

Tests added for every fix; unanimous adversarial review (no update-outage risk —
all push paths verified to send the digest).

decnet/swarm/log_forwarder.py

@@ -108,6 +108,9 @@ def build_worker_ssl_context(agent_dir: pathlib.Path) -> ssl.SSLContext:
             f"no worker bundle at {agent_dir} — enroll from the master first"
         )
     ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    # Pin an explicit TLS 1.2 floor so it can't silently regress if a future
+    # runtime lowers the implicit default (ASVS V9.1.4).
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
     ctx.load_cert_chain(
         certfile=str(agent_dir / "worker.crt"),
         keyfile=str(agent_dir / "worker.key"),

decnet/swarm/log_listener.py

@@ -61,6 +61,9 @@ def build_listener_ssl_context(ca_dir: pathlib.Path) -> ssl.SSLContext:
                 f"master identity missing at {master_dir} — call ensure_master_identity first"
             )
     ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    # Pin an explicit TLS 1.2 floor so it can't silently regress if a future
+    # runtime lowers the implicit default (ASVS V9.1.4).
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
     ctx.load_cert_chain(certfile=str(cert), keyfile=str(key))
     ctx.load_verify_locations(cafile=str(ca_cert))
     ctx.verify_mode = ssl.CERT_REQUIRED