security: harden moontrace security boundaries

[brickfrog]

What changed

• escape control characters in human-readable event, field, and trace-context output while leaving JSON serialization unchanged
• bound traceparent and tracestate parsing at 512 characters, avoid eager split/collect work, and reject duplicate wire tracestate keys
• seed trace/span identifiers from 32 bytes of platform entropy when available, retaining the clock-derived seed only as a fallback
• request owner-only 0600 permissions for newly created native file-subscriber logs and gzip rotations without changing existing file modes
• stream default OTLP HTTP response bodies with a 64 KiB ceiling and classify overflow as a non-retryable request error
• replace mutable MoonBit installer piping with pinned, SHA-256-verified toolchain and core archives shared by both workflows
• document the new limits, compatibility behavior, and permission contract

Why

The Codex Security scan surfaced several source-to-sink hardening opportunities in library-owned boundaries: attacker-controlled telemetry reaching human-readable output, unbounded propagation headers and collector responses, deterministic process seeding, permissive default file creation, and mutable CI bootstrap artifacts. This groups each shared root cause into one narrow change with focused regression coverage.

The flamegraph label findings are intentionally deferred: those files are explicit operator-controlled profiling artifacts, and the repository does not expose a lower-trust renderer or ingestion boundary that would justify changing their established format in this patch.

Impact

• no public .mbti interface changes
• malformed or oversized propagation state is rejected; parse_span_context still preserves a valid traceparent while dropping invalid tracestate
• human-readable control characters become visible escapes; structured JSON output is unchanged
• OTLP response bodies over 65,536 bytes now fail closed and are not retried
• existing log permissions are preserved; only files created by the subscriber request 0600
• no version bump, tag, or release is included

Validation

• moon info && moon fmt (clean second format pass; no .mbti diff)
• moon check --target native
• moon check --target js
• moon check --target wasm-gc
• moon test --target native — 293/293 passed
• moon test --target js — 280/280 passed
• moon test --target wasm-gc — 265/265 passed
• bare moon test — 293/293 passed, exercising the preferred native target
• moon build --target native --release
• focused file subscriber tests — 9/9 passed
• focused OTLP transport tests — 25/25 passed
• live Unix mode probe under umask 022: new active/raw-rotated/gzip files were 0600; a pre-existing 0640 file remained 0640
• bash -n .github/scripts/setup-moonbit.sh
• disposable live CI bootstrap: both archive hashes verified, core bundles completed, and pinned compiler 0.10.5+5e7afb0c0 ran successfully
• git diff --check main...HEAD

shellcheck and actionlint were not run because they are not installed in the development environment; the remote workflows exercise the bootstrap and workflow definitions.