fix(audit-2026-06-11/C-2+F-SE-H-03): reject control chars in content-type; disable Rhai debug

C-2 follow-up: sanitize_stored_content_type previously let a CRLF pass
through an allowlisted prefix (e.g. "image/png\r\nX-Injected: 1" matched
the image/ branch and returned the original), which would inject a
response header / panic HeaderValue on download. Now any control byte
(<0x20 or 0x7f) coerces to application/octet-stream up front.

F-SE-H-03: disable_symbol("debug") to match "print" (the comment
already claimed both were disabled) so scripts can't write
attacker-controlled bytes to the operator's stderr.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/executor-core/src/engine.rs

@@ -403,7 +403,13 @@ fn build_engine(limits: Limits, logs: Option<Arc<Mutex<Vec<LogEntry>>>>) -> Rhai
     // Rhai's built-in `print` and `debug` map to stdout/stderr by
     // default; we never want scripts dumping there directly. Disable
     // them so scripts route all output through `log::*` instead.
+    //
+    // Audit 2026-06-11 (F-SE-H-03) — `debug` was previously left
+    // enabled despite this comment, so a script could write
+    // attacker-controlled bytes (control chars, ANSI escapes) into the
+    // operator's stderr/journald stream. Disable it to match `print`.
     engine.disable_symbol("print");
+    engine.disable_symbol("debug");
 
     if let Some(logs) = logs {
         engine.register_static_module("log", build_log_module(logs).into());