fix(hub): clear parser-owned session key bytes

[gnanirahulnutakki]

Summary

• copy the validated Ed25519 session key into runtime-owned memory
• clear the parser-owned private-key slice before returning
• prove the returned key is non-aliasing, unchanged, and cryptographically usable

Closes #310.
Part of #21.

Verification

• go test -race -count=100 ./internal/hubruntime -run ^TestCopyAndClearSessionPrivateKeyTransfersOwnership$
• full make ci on exact rebased source with pinned golangci-lint v2.12.2, govulncheck v1.6.0, and checksum-verified promtool v3.13.1
• Trivy secret scan: zero findings
• complete two-file CodeRabbit review: zero findings
• SSH-signed DCO/GSTACK commit: f3eac6b86f402495f5f31b478d41fa1761f979ee

Security and cost

This narrows the lifetime of one redundant parser-owned signing-key copy. It is defense in depth, not a guarantee that every compiler/runtime copy is erased. It changes no IAM, network path, deployment input, storage, telemetry, or recurring cost. README was reviewed; no operator-facing behavior changed, so no README update is warranted.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: acc29a13-dfcf-411a-83cd-2cf8a27b8998

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/clear-session-key-copy-20260722

---

_{Comment @coderabbitai help to get the list of available commands.}