What

• Store bot-auth secret material as raw seed bytes and explicitly zeroize them in Drop.
• Keep Debug output redacted for BotAuthConfig.
• Add regression test verifying seed bytes are wiped on drop.
• Keep bot-auth feature wired to zeroize.
• Update threat-model and request-signing specs to reflect TM-CRY-001 mitigation.

Why

Issue #1177 requires explicit key-material hygiene: prevent long-lived secret exposure in memory and improve security-audit clarity around cryptographic material handling.

How

• BotAuthConfig now holds seed: [u8; 32] and calls seed.zeroize() in Drop.
• SigningKey is reconstructed only at use sites (keyid, signing, public-key derivation).
• Added tests:
  • seed_zeroized_on_drop
  • debug_redacts_key_material
• Updated docs/specs:
  • Threat category TM-CRY and mitigation TM-CRY-001
  • Request-signing spec language updated to Drop-based zeroization

Validation

• cargo fmt --check
• cargo test -p bashkit --features bot-auth network::bot_auth -- --nocapture
• cargo clippy -p bashkit --features bot-auth -- -D warnings
• just pre-pr (known environment failure in bash comparison due missing host tools bc/file, unrelated to this patch)

Closes #1177.