Harden PII and credential leakage across picker, chat, GitLab, bell, /clear

[daiv-agent]

This change hardens several surfaces against leaking PII or credentials. The user picker stops returning email addresses to any authenticated member; the chat relay sanitizes RUN_ERROR event messages before they are yielded (not just before persistence); the GitLab upload download validates and URL-encodes the attacker-influenced path so the PRIVATE-TOKEN cannot be sent to a traversed path or another host; the notifications bell only marks notifications read on HTMX requests; and the /clear slash command no longer echoes raw exception text into the issue thread.

Key Changes:

• User picker PII (accounts/views.py, _user_picker_list.html, _avatar.html): dropped email from the .only(...) queryset, removed the email: field from the addUser(...) click payload, and switched the avatar label to owner_label|default:user.name|default:user.email with the picker passing owner_label=u.username; the row's secondary line now shows u.username instead of u.email. Email is still matched on for search but never rendered.
• Chat RUN_ERROR sanitization (chat/api/streaming.py): the upstream RunErrorEvent is now rewritten to a sanitized RunErrorEvent carrying RUN_FAILED_MESSAGE before it is yielded, so a reader that rejoins the run via the relay never receives the raw exception text (previously only the persisted Run.error_message was sanitized).
• GitLab upload path validation (codebase/clients/gitlab/client.py): added _safe_gitlab_upload_path, which rejects control characters, schemes/netlocs (absolute or protocol-relative URLs), non-/uploads/ prefixes, and .. segments, and URL-encodes each segment so encoded traversal (%2e%2e) stays literal. get_project_uploaded_file now uses the safe path and returns None (with a warning) when unsafe.
• Notifications bell mutation gating (notifications/views.py): Notification.mark_all_read_for now runs only when the request carries the HX-Request header (is_htmx), so a plain GET (prefetch, top-level navigation, crawler) no longer silently clears the unread badge.
• /clear exception handling (slash_commands/actions/clear.py): the failure reply is now a fixed generic message instead of interpolating the raw exception text, which could embed host- or credential-bearing URLs.
• Tests: added/updated coverage in test_picker_view.py, test_streaming.py, test_client.py (parametrized _safe_gitlab_upload_path cases plus async download tests), test_nav_publishers.py, test_views_bell.py, and test_clear.py asserting the raw values never leak.

---

⚠️ DAIV can make mistakes. Please review the changes and merge the MR if everything looks good.
🔗 Generated by DAIV — view sessions

---

💡 Instructions for the reviewer:

• 💬 Just leave comments/reviews mentioning @daiv-agent to get DAIV to address them for you.