feat: add opt-in RTK shell output filtering

[danny-avila]

Summary

I added request-scoped RTK output filtering for Bash executions while preserving raw execution as the default and keeping all command rewriting inside the sandbox boundary.

• Add shell_output_filter: "raw" | "rtk" to the public and internal execution contracts with Bash-only validation at both trust boundaries.
• Build RTK v0.45.0 from its immutable release commit with Rust 1.91 so amd64 and arm64 binaries match the Debian bookworm sandbox glibc baseline.
• Execute RTK rewrites from the Bash runtime wrapper inside NsJail, preserve script arguments, and fail open to the original script when rewriting is unsupported or unavailable.
• Keep RTK history and tee artifacts ephemeral for opted-in runs and reserve the internal environment controls against caller override.
• Record low-cardinality Prometheus execution outcomes and stdout/stderr byte sizes for raw-versus-RTK comparisons.
• Document the opt-in request field, direct binary availability, image behavior, metrics, and Apache-2.0 attribution.

Change Type

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Testing

• Ran cd api && bun run build.
• Ran cd service && bun run build; the existing Rollup export/circular-dependency warnings remain unchanged.
• Ran cd api && bun test src/bash-run.test.ts src/job-helpers.test.ts (69 passed).
• Ran cd service && bun test src/config.spec.ts (17 passed).
• Ran bash -n docker/bash-run.sh docker/package-init.sh.
• Built the rtk-builder target from both Dockerfiles on linux/arm64 and verified rtk 0.45.0.
• Verified the real binary rewrites git status && git diff to rtk git status && rtk git diff, honors the ephemeral RTK environment, and creates no files under sandbox HOME.
• Attempted the complete API and service suites; this managed environment blocks their existing ephemeral socket listeners and external Redis/k6 dependencies, and inherited AWS_CA_BUNDLE trips existing hardened-startup fixtures. No focused RTK test failed.

Test Configuration:

• macOS arm64 host
• Docker Desktop linux/arm64 builder
• Bun 1.3.13
• RTK 0.45.0
• Rust 1.91 bookworm builder

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in complex areas
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 737eb2c130

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[macroscopeapp]

🟡 Medium docker/bash-run.sh:11

grep -q 'BASH_SOURCE' matches any literal occurrence of the string, including comments, quoted strings, or commands like printf 'BASH_SOURCE'. A script that merely mentions the text but never actually inspects the variable bypasses RTK rewriting entirely and runs raw, silently defeating the rtk output filter the user opted into. Consider checking for actual parameter expansion syntax (e.g. BASH_SOURCE[ or $BASH_SOURCE) instead of a plain substring search.

Suggested change

	if ! grep -q 'BASH_SOURCE' -- "$1" 2>/dev/null; then
	if ! grep -qE 'BASH_SOURCE\[' -- "$1" 2>/dev/null; then

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @docker/bash-run.sh around line 11:

`grep -q 'BASH_SOURCE'` matches any literal occurrence of the string, including comments, quoted strings, or commands like `printf 'BASH_SOURCE'`. A script that merely mentions the text but never actually inspects the variable bypasses RTK rewriting entirely and runs raw, silently defeating the `rtk` output filter the user opted into. Consider checking for actual parameter expansion syntax (e.g. `BASH_SOURCE[` or `$BASH_SOURCE`) instead of a plain substring search.