3.17.1: secrets in log lines and telemetry, 3.17.0 snapshot persistence, proxy identity headers, decorator footguns, config revalidation, Docker gate #93

Tracking issue for the 3.17.1 release branch fix/log-sensitive-headers.

Found on the live 3.17.0 stack and by adversarial review during 2026-09-02/03:

• Sensitive request data (headers, query string, fragment, userinfo, path, body fields, JSON carried in any of them) printed verbatim in guard log lines and shipped raw in the pattern_detected telemetry preview and reason.
• 3.17.0 regression: the last-known dynamic rules snapshot rejected guard-agent's rules object, so nothing persisted, rules re-applied every poll and emergency mode kept halving auto_ban_threshold.
• Proxy identity headers (x-real-ip, x-forwarded-for, ...) tripped the SSRF pattern behind nginx and auto-banned clients.
• require_headers was a silent no-op for non-sentinel values; require_referrer never matched scheme-prefixed origins.
• Thirteen collection-typed SecurityConfig fields were not revalidated on reassignment; exclude_paths accepted a bare string; a validation-order bug raised on valid rule lists.
• make test could not collect the suite inside the Docker image since 3.13.0 (no Makefile, no git, no editable install).
• Two modules had regressed to maintainability rank B.

Gates added: live-smoke.yml (real stack with fastapi-guard's example app, nginx, gunicorn, Redis, guard-agent against a stub SaaS, OTLP stub; completeness gate over every SecurityConfig field, decorator and check) and ecosystem-gate.yml (consumer suites on the PR wheel).