[SteveGilvarry]

Host:

• HLS segments were written under /tmp/hls at 0755. Any local user
  could read live video, or create the path first as a symlink and choose
  where segments went. The directory is now 0700 and a symlink or
  another user's directory is refused.
• /tmp/mysql.sock was picked automatically when no standard socket
  existed, so a local user could stand in for the database. It now has to
  be named in db.socket.
• Startup warns when a signing key is readable by other users.
• prod.toml and zm-api.env were installed 0644; setup-instance.sh
  makes them 0640 root:.
• generate-jwt-keys.sh left the private key world-readable until its
  chmod. deploy-dev.sh uploaded to a fixed name in /tmp and installed it
  as root. The test databases were published on every interface.

CI:

• The release .deb was built without --locked.
• Workflow tokens are read-only except in the jobs that publish.
• The two third-party actions that run with a write token are pinned to
  commits.

Notes for review

• Last of five stacked PRs; based on the input validation PR.
• Not exercised: the packaging e2e test (needs Docker) and the workflow edits, which are only YAML-checked. CI on this PR is their first run.
• Behaviour change: an install whose database socket is /tmp/mysql.sock must set db.socket, and an HLS storage path that is a symlink is refused.
• The dependency bumps from the audit are left to chore(deps): keep the security audit passing on November's advisories #273.

🤖 Generated with Claude Code