[sec-check] fix(systemd): guard hive-snapshot.service against planted /tmp checkout (#5483)

[kubestellar-hive]

Security Fix

Claims: systemd/hive-snapshot.service, new src/deploy/test_hive_snapshot_unit_contract.sh — the #5483 / #5435-class systemd-unit-executes-from-/tmp cluster. Disjoint from hold PR #4032 (proxy auth injection: src/pkg/proxy/, src/pkg/github/, src/pkg/config/proxy_inject*).

hive-snapshot.service executed /tmp/hive/dashboard/publish-snapshot.sh as User=dev with no ownership guard. /tmp is world-writable and cleared on reboot; the sticky bit does not prevent creating /tmp/hive/dashboard/publish-snapshot.sh in the window before hive-deploy repopulates the checkout. A local unprivileged user who won that race got code execution as dev on the next hive-snapshot.timer fire — and the real script reads the GitHub App token from /var/run/hive-metrics/gh-app-token.cache, so planted code runs with a path to that credential.

What this changes

Same class and same fix as #5435 / #5481:

• ExecStartPre=/usr/local/bin/hive-checkout-guard.sh /tmp/hive/dashboard publish-snapshot.sh — the existing guard (already installed by hive-deploy since fix(security): stop hive-discord.service executing code planted under /tmp (#5435) #5481) generalizes unmodified; its exit status is the assertion, so a violation stops ExecStart.
• Hardening pass mirroring hive-discord.service: NoNewPrivileges, ProtectSystem=full, ProtectHome=read-only, PrivateDevices, RestrictSUIDSGID. PrivateTmp and ProtectSystem=strict are deliberately absent (both would break execution out of the /tmp checkout) and are pinned absent by the contract test, per hive-snapshot.service executes publish-snapshot.sh from /tmp/hive with no ownership guard (same class as #5435) #5483's guidance.
• src/deploy/test_hive_snapshot_unit_contract.sh executes the guard with this unit's argument shape — the entrypoint is the 755 script itself, so the writable-file check (not the exec bit) is the live one — and pins the unit's directives. 13/13 passing locally; the existing [sec-check] hive-discord.service executes node bot.js from world-writable-parent /tmp/hive/discord — local code-execution as service user #5435 discord contract test still passes 21/21.

Not in this PR (App token lacks workflows permission)

A maintainer should wire the test into .github/workflows/v2-ci.yml next to the #5435 step:

      # #5483: hive-snapshot.service had the same exposure — ExecStart resolved
      # /tmp/hive/dashboard/publish-snapshot.sh out of a world-writable,
      # reboot-cleared parent, and the script reads the GitHub App token cache.
      - name: hive-snapshot.service does not execute planted code (#5483)
        working-directory: .
        run: bash src/deploy/test_hive_snapshot_unit_contract.sh

Refs #5483 (CI wiring above still pending, so not using a closing keyword)

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-fable-5

[github-actions]

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

Check out what's new:

• KubeStellar Console — Live multi-cluster dashboard
• Marketplace — Community extensions
• Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey