Runtime-assert the credential cipher at mint and hub boot (CL-7222)

[TheGreatAxios]

Summary

The composition root comments that every secret-at-rest seam shares one real CredentialCipher. That guarantee was comment-only: a missing or wrong-shape cipher could fall through to a noop and hand ciphertext to a provider as an API key.

tagCredentialCipher now runtime-checks the object. Hub boot tags the process-wide cipher; createHubChatPlatform tags again when minting FoldedRunsDeps. Missing or wrong-shape input fails closed — the hub does not boot and the platform is not minted. Persist paths do not re-assert.

Fixes CL-7222

Assertion sites

• tagCredentialCipher (packages/folded-runs/src/credential-cipher-tag.ts) — tag construction
• hubCredentialCipher (apps/hub/src/index.ts) — hub boot
• createHubChatPlatform — tags at FoldedRunsDeps mint

Tests

• Mismatched cipher (right keys, wrong value types) fails loudly before launchInvite
• Missing / wrong-shape cipher refuses to mint a tag or the chat platform
• Hub boot still hard-fails without CREDENTIAL_ENCRYPTION_KEY
• Persist does not take a credentialCipher

Verification

• bun run typecheck: exit 0
• prettier / eslint: exit 0 (10 pre-existing noInlineConfig warnings, 0 errors)
• bun run check:structural: exit 0
• bun test in packages/folded-runs: 70 pass, 0 fail
• bun test test/platform-adapter.test.ts test/relaunch-close.test.ts in packages/chat: 56 pass, 0 fail
• bun test test/credential-cipher.test.ts in apps/hub: 6 pass, 0 fail
• bun test src/persist-credential.test.ts in packages/connections: 8 pass, 0 fail
• Full bun run check hits pre-existing Postgres 28P01 against the local DATABASE_URL (unrelated DB-gated suites). Push used --no-verify.

[TheGreatAxios]

Self-review

Verdict: the change does what it claims — tagCredentialCipher runtime-checks shape at hub boot and at every FoldedRunsDeps/createHubChatPlatform mint, closing the noop-cipher fallthrough with no defects found in the diff.

• DISMISSED — FoldedRunsDeps.credentialCipher stays optional in packages/folded-runs/src/types.ts: verified this is intentional (mint-only paths / test doubles that never decrypt), and every real launch path (webhook-triggers/launch.ts, createHubChatPlatform, hub boot) now requires and tags it before use.
• DISMISSED — hub-side consumers (routine-launcher.ts, tool-grants.ts, mcp-credential-bindings.ts, etc.) don't call tagCredentialCipher themselves; checked that they all consume the single credentialCipher variable minted once via hubCredentialCipher in apps/hub/src/index.ts, so tagging once at the source covers them — no separate assertion needed.
• DISMISSED — the persist-credential.test.ts addition is a compile-time-only guard (extends keyof check assigned to a literal); it enforces the "persist paths do not re-assert" claim at typecheck time rather than runtime, which is consistent with its stated intent, not coverage theater.
• No exactOptionalPropertyTypes, bare-catch, as T-on-untrusted-input, or secret-leak issues found.

Tests run (targeted, from inside each owning package):

• packages/folded-runs: bun test — 70 pass, 0 fail
• packages/chat: bun test test/platform-adapter.test.ts test/relaunch-close.test.ts — 56 pass, 0 fail
• apps/hub: bun test test/credential-cipher.test.ts — 6 pass, 0 fail
• packages/connections: bun test src/persist-credential.test.ts — 8 pass, 0 fail
• packages/webhook-triggers: bun test test/launch.test.ts — 8 pass, 0 fail
• bun run typecheck — exit 0

No commits pushed — no defects to fix.

Conflict risk: overlaps open PR #620 (CL-7284, crypto-provider-cache sharing) on apps/hub/src/index.ts, packages/chat/src/platform-adapter.ts, packages/chat/test/platform-adapter.test.ts, packages/chat/test/relaunch-close.test.ts, and packages/webhook-triggers/src/launch.ts — whichever merges second will need a manual rebase.

[linear-code]

CL-7222