fix(fleet): harden audit and refresh boundaries

[gnanirahulnutakki]

Summary

• reject malformed UTF-8 before durable audit hashing and repair the framing fuzz oracle
• bind coalesced fleet refreshes to a value-free hub lifecycle context while preserving per-caller cancellation isolation
• document the lifecycle contract and add direct adversarial, concurrency, and construction-site regressions

Security and reliability

This closes a writer/verifier drift that could emit locally accepted audit records rejected by the portable verifier. It also prevents a stuck backend refresh from outliving hub shutdown without leaking caller context values into shared work. No IAM, network exposure, persistent schema, or recurring cloud cost changes.

Verification

• make ci
• make e2e-isolation
• make release-check
• make e2e-kind KIND=/Volumes/EXTENDED/MacData/tools/bin/kind
• go test -race -count=10 ./internal/hubfleet ./internal/pep ./internal/tenancy ./internal/hubdb
• repaired audit fuzzer: 250,000 executions
• all 23 repository fuzz targets: 50,000 executions each
• focused gosec: zero findings

The branch is based directly on verified dev merge SHA f0e071aa1ae8c3403709803336bef0f7c3abbccf.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 88028cc2-cdaf-41e4-ad2a-1f8bc6f79390

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/audit-hardening-20260721

---

_{Comment @coderabbitai help to get the list of available commands.}