feat(harness): hard-block the embedded agent from reading .env; drop WebFetch

[itelo]

Summary

Closes the gap where the wizard's embedded integration agent was only instructed not to read secrets (a system-prompt line), with no enforcement. A developer's .env routinely holds secrets beyond the Seam key — DB URLs, Stripe keys, etc. — that must never enter the model context.

Implements ENG-2925.

Changes

• PreToolUse deny hook (src/lib/steps/harness/anthropic.ts): blocks any tool call whose input targets .env / .env.* (except .env.example). A deny overrides the broad Read allow and fires for every tool, so Read/Grep/Edit/Write are all covered.
• Removed WebFetch from ALLOWED_TOOLS (the "review WebFetch" ask): arbitrary web egress isn't needed — references come from the seam-docs MCP, and the pi harness already omits it — and it was the obvious exfiltration channel. Reintroduce behind an allowlist if a real need appears.
• Shared helper src/lib/steps/harness/secret-paths.ts (isSecretFilePath / toolInputTouchesSecret) with unit tests.

Already safe (unchanged, for context)

• The Anthropic key never leaves Seam's server — buildAgentEnv drops ANTHROPIC_API_KEY and injects only the short-lived scoped wizard token.
• The Seam key stays out of git — .env gitignored + value-less .env.example.
• No Bash / no subagents in either harness.

Scope / follow-ups (in ENG-2925)

• pi harness (eval-only) guard is deferred: pi only runs under SEAM_WIZARD_HARNESS=pi (eval), the eval workspace carries no real secret, and pi's ToolDef.execute shape isn't documented enough to guard without guessing.
• Residual: a broad Grep across the repo could still surface secret lines from other files; a PostToolUse redaction pass is the natural next step. The direct-.env-access vector is closed here.

Testing

• npm run lint clean
• npm run typecheck clean
• npm test — 155 passed (+5 new: secret-paths.test.ts)

Security & Compliance

• Security hardening (defense-in-depth); no secrets in the diff.

🤖 Generated with Claude Code