[Praket7]

Summary

This change fixes the three reproduced audit findings.

Progress cursors now point only to delivered events. watch_turn returns bounded pages without silently advancing past omitted events.

Waiting turns can be stopped after the original request has ended. Resume routes through the owning backend and updates the same canonical turn only when the backend confirms a terminal result.

Text redaction now covers password variants, multiline PEM private keys, nested values, and recognized URL secrets.

The README has been rewritten in plain language. It includes an overview image, a measured health graphic, and a 12 second Remotion explainer. A separate checklist records the steps needed to verify signed in Desktop and CLI behavior.

Verification

• pnpm typecheck
• pnpm test with 210 passing
• pnpm build
• pnpm pack:check
• pnpm audit --prod with no known vulnerabilities
• Remotion render completed at 12 seconds in H.264
• npm audit --omit=dev in the Remotion project with no known vulnerabilities
• npm package dry run confirmed media and source are included without node_modules
• README prose style check passed

Live signed in Desktop and CLI acceptance has not been performed. The checklist makes that boundary explicit.