fix(audit-2026-06-11/C-2+F-SE-H-03): reject control chars in content-type; disable Rhai debug

C-2 follow-up: sanitize_stored_content_type previously let a CRLF pass
through an allowlisted prefix (e.g. "image/png\r\nX-Injected: 1" matched
the image/ branch and returned the original), which would inject a
response header / panic HeaderValue on download. Now any control byte
(<0x20 or 0x7f) coerces to application/octet-stream up front.

F-SE-H-03: disable_symbol("debug") to match "print" (the comment
already claimed both were disabled) so scripts can't write
attacker-controlled bytes to the operator's stderr.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/engine.rs

@@ -403,7 +403,13 @@ fn build_engine(limits: Limits, logs: Option<Arc<Mutex<Vec<LogEntry>>>>) -> Rhai
     // Rhai's built-in `print` and `debug` map to stdout/stderr by
     // default; we never want scripts dumping there directly. Disable
     // them so scripts route all output through `log::*` instead.
+    //
+    // Audit 2026-06-11 (F-SE-H-03) — `debug` was previously left
+    // enabled despite this comment, so a script could write
+    // attacker-controlled bytes (control chars, ANSI escapes) into the
+    // operator's stderr/journald stream. Disable it to match `print`.
     engine.disable_symbol("print");
+    engine.disable_symbol("debug");
 
     if let Some(logs) = logs {
         engine.register_static_module("log", build_log_module(logs).into());

crates/executor-core/tests/engine.rs

@@ -49,6 +49,22 @@ fn validate_rejects_syntax_errors() {
     assert!(matches!(err, ExecError::Parse(_)));
 }
 
+#[test]
+fn debug_and_print_symbols_are_disabled() {
+    // Audit 2026-06-11 (F-SE-H-03) — neither `print` nor `debug` may
+    // reach the host's stdout/stderr; both are disabled at the symbol
+    // level, so a script that calls them fails to parse/validate.
+    for src in [r#"print("x")"#, r#"debug("x")"#] {
+        let err = engine()
+            .validate(src)
+            .expect_err("disabled output symbol should be rejected");
+        assert!(
+            matches!(err, ExecError::Parse(_)),
+            "{src} should be a parse-time rejection, got {err:?}"
+        );
+    }
+}
+
 #[test]
 fn returns_unwrapped_value_as_200_body() {
     let resp = engine()