fix(runtime-services): keep database passwords ephemeral

[chubes4]

Summary

• follow up merged PR feat(runtime-services): support isolated external MySQL providers #2046 with isolated external MySQL-compatible runtime services
• propagate generic name-only connector secret target mappings into every PHP-WASM worker
• reserve connector targets against every recipe, managed, startup, and per-execution environment source before provisioning or execution

Connector target contract

Managed providers return env, secretEnv, and secretEnvTargets. A mapping such as { DB_PASSWORD: MYSQL_PASSWORD } allows a configurable secret output name to feed the canonical PHP connector input without copying the value into non-secret environment or generated files.

Before provisioning, WP Codebox validates declared connector targets against:

• inputs.runtimeEnv
• inputs.secretEnv
• distribution.env
• every managed service output
• every other connector target
• caller-provided reserved runtime environment names

Collisions and ambiguous mappings fail before any provider command runs. Aggregate-time validation repeats the checks against actual provider results; if an unexpected target appears after allocation, all provisioned resources are released. Runtime creation also rejects direct runtime/distribution shadows before writing bootstrap files, and execution rejects per-command environments and runtime-env-json overrides that target connector names.

Execution-path security

The tracked Playground CLI patch forwards in-memory phpEnv into Emscripten ENV for v1/v2 primary and spawned workers. This covers installation/startup blueprints, direct PHP, HTTP/browser/preview traffic, probes, CLI, request workers, and concurrent process identities.

Generated command and ability PHP exclude every mapped secret source. wp-config.php, auto-prepend PHP, request-worker payloads, recipes, snapshots, evidence, and persisted artifacts contain no connector secret values.

Coverage

• noncanonical outputs.password: MYSQL_PASSWORD safely targets canonical DB_PASSWORD
• public runtime, declared recipe secret, and distribution target shadows fail validation
• managed output collisions and multiple connectors targeting DB_PASSWORD fail before provisioning
• an induced post-allocation target collision verifies rollback
• startup and per-execution runtime target overrides fail before generated PHP can run
• multiple distinct connector targets resolve through the in-memory channel
• recursive artifact/WordPress scans and generated source assertions exclude secret values
• password-bearing concurrent process identities verify spawned-worker inheritance and isolation
• release-package coverage verifies the Playground patch in shipped artifacts

Tests

• npm run build:release
• npm run test:runtime-services
• npm run test:runtime-services-lifecycle
• npx tsx tests/playground-cli-runner-bootstrap-ini.test.ts
• npm run test:redaction
• npm run test:recipe-secret-env
• npm run test:schema-parity
• npm run test:recipe-validation-descriptors
• npm run test:agent-task-contracts
• npm run test:bounded-runtime-plan
• npm run test:bounded-recipe-plan
• npm run test:bounded-recipe-plan-integration
• npm run test:release-package-coverage
• git diff --check

The Docker-backed MySQL/MariaDB integration is part of PR CI; the local host has no Docker and reports its explicit Docker-unavailable skip.

Follow-up to #2046.