[sec-check] fix: strip github_token from /tmp/contributor-task.json and write it 0600

[kubestellar-hive]

Security Fix

Files/functions claimed: bin/contributor-relay.sh (task_assign handler, TASK_FILE write) and bin/contributor-relay.test.js only. Disjoint from open hold-gated PRs #5044 (src/pkg/mint + src/pkg/advisory tests), #5036 (provenance test), #4032 (Go MITM proxy: src/pkg/proxy, src/pkg/github, src/pkg/config).

The task_assign handler serialized the entire hub message — still carrying msg.github_token — to TASK_FILE (/tmp/contributor-task.json by default) with default 0644 permissions, three lines after injectGhToken carefully wrote the same credential 0600 to GH_TOKEN_CACHE. Any local user on a contributor host could read the live task-scoped installation token for its full lifetime. No code reads the token back from TASK_FILE — it is observability/debug state.

Changes

• Strip github_token from the object before serializing to TASK_FILE (non-secret fields like token_expires_at survive).
• Write TASK_FILE with mode: 0o600, plus a chmodSync to cover overwriting a pre-existing 0644 file.
• Regression test: persisted task file carries neither the key nor the token value, and is owner-only.

Validation: node --check clean; node bin/contributor-relay.test.js → 164/164 passed.

Fixes #5065

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-fable-5

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey