fix(security): close 6 parity-drift findings from the post-#197 audit

[nicolotognoni]

Summary

Closes the 6 confirmed findings from the post-#197 security audit. Five are cross-language parity drift — a guard present in one SDK but missing or weaker in the other (the same genre as #195/#197). No version bump (deferred to a release PR).

Findings fixed

Sev	Fix	SDK
HIGH	Outbound fetch() now uses redirect: 'error' so a 302 → 169.254.169.254 can't bypass the SSRF guard (which validated only the first hop). Python was safe (httpx follow_redirects=False).	TS
MED	Caller DTMF no longer logged at INFO (PIN/card/SSN) — dropped to DEBUG with no value, matching Python.	TS
LOW	Call-id path traversal: new shared safe_path_segment/safePathSegment folds POSIX and Windows separators + neutralises .., so a forged carrier call id can't escape the recording/call-log dir on Windows.	both
LOW	Tool/consult response size cap enforced during the read — Python streams + bounds (tool_executor.py, consult.py); TS rejects an oversized Content-Length up front, timeout as the chunked backstop.	both
LOW	Transfer-destination phone numbers masked in logs (last-4), parity with Python.	TS
LOW	Variable sanitiser strips Unicode line separators (U+0085/U+2028/U+2029), closing a line-break prompt-injection gap.	both

Plus a consistency fix: the Python on_message WebSocket guard now routes through the shared getpatter/ssrf.py so it folds non-canonical IP spellings like its HTTP sibling.

Implementation notes

• Redirect (HIGH): redirect: 'error' added to all 6 guarded sinks (llm-loop.ts, handler-utils.ts, consult.ts ×3, remote-message.ts).
• Response cap: Python switches client.post → client.stream(...) + aiter_bytes() with an in-loop byte cap (and a Content-Length pre-check). The 3 test_new_features.py executor tests that mocked .post were updated to mock .stream. TS keeps resp.json()/text() (so existing fetch mocks stay valid) but adds a defensive resp.headers?.get('content-length') pre-check — a deliberate lower-risk choice on the TS hot path, which is already time-bounded by AbortSignal.timeout; Python (no timeout backstop) gets the full streaming bound.
• Path/sanitiser helpers are shared and mirrored across SDKs to prevent future drift.

Breaking change?

No. These reject inputs that were always meant to be blocked or move PII off INFO logs — no public API change. redirect: 'error' matches Python's long-standing default.

Test plan

• Python pytest tests/ — 2890 passed, 8 skipped, 2 xfailed (+14 new in tests/security/test_hardening.py).
• TypeScript npm test — 2301 passed, 9 skipped (+12 new SEC-6/7/8 in tests/security/security.test.ts) + npm run lint clean.
• No new ruff findings vs main; no version bump (all three version files stay 0.6.9).
• E2E smoke with a real call before release (non-blocking).

Docs updates

CHANGELOG.md ### Security entry added. No public-API doc surface changed.