security: tool output scrubbing misses raven's own oauth token files #842

Problem

Tool output scrubbing (added in #833) does not cover Raven's own OAuth token files, so a turn that reads one hands the access and refresh tokens to the model.

Two passes scrub a tool result before a model sees it (raven/config/held_secrets.py scrub_tool_output):

1. scrub_held_secrets -- exact match on the values in config.json only;
2. redact_home_config_read (raven/security/redact.py) -- pattern redaction when the call reaches into a dot-directory of the home.

The fix for the workspace false positive in #833 made _home_config() skip all of Raven's home (~/.raven), on the grounds that Raven's own keys are covered by pass 1. That holds for config.json, but not for the sign-in tokens under get_oauth_dir() (~/.raven/oauth/<provider>/...: chatgpt/auth.json, github_copilot/, MiniMax, litellm). They are in neither pass.

Repro

With #833 in, using a fake token:

import os
from raven.config.held_secrets import scrub_tool_output

home = os.path.expanduser("~")
tok = '{"access_token": "eyJhbGciOiJSUzI1NiJ9.FAKEPAYLOAD.sig", "refresh_token": "rt_FAKE0123456789abcdef"}'
print(scrub_tool_output({"path": f"{home}/.raven/oauth/chatgpt/auth.json"}, tok))  # unchanged
print(scrub_tool_output({"path": f"{home}/.codex/auth.json"}, tok))                # [redacted]

A refresh token is a long-lived account credential; once in a tool result it is in the session record and the provider's logs. The self-config skill tells the agent not to open credential stores, but #833's own measurement is that a model diagnosing an agent reads its settings anyway.

Suggested fix

Narrow the exclusion in _home_config() from Raven's whole home to the directories where a coding turn reads its own source: <raven home>/workspace and <raven home>/tmp (and the bound workdir). ~/.raven/oauth/... and the rest of Raven's home then stay under the pattern pass. Correct the _home_config() docstring, which says Raven's own keys are covered by the exact-match pass.

Verify: in tests/test_security_untrusted_context.py, assert a read of ~/.raven/oauth/<provider>/auth.json is redacted, next to the existing case that ~/.raven/workspace/... and ~/.raven/tmp/... stay unchanged; uv run pytest -q tests/test_security_untrusted_context.py.

Not a regression against the release before #833 (there was no scrubbing then); a gap in the new protection.