ci/security/test: automated audit fixes for QuantRuntimeSettings

[Pigbibi]

Summary

• redact secret-like matches in the Codex review gate output
• add a regression test so the gate never echoes matched secret values
• install/build-check the Python package in validate CI and run pip check

Problems found

• python/scripts/gate_codex_app_review.py echoed matched secret-like assignments in violation text
• validate CI did not verify Python dependency consistency
• validate CI did not exercise Python package buildability

Fixes applied

• changed secret scan output to field=<redacted>
• added python/tests/test_gate_codex_app_review.py
• updated .github/workflows/validate.yml to install the local package, run pip check, and build ./python

Security impact

• reduces risk of secret-like values being reprinted into CI logs / summaries

Architecture impact

• no public API change; only audit gate output and CI coverage tightened

Tests run

• python -m pip check
• python3 python/scripts/build_config.py --check
• python3 python/scripts/runtime_settings.py validate
• python3 -m unittest discover -s python/tests -v
• python -m build ./python
• actionlint .github/workflows/validate.yml
• git diff --check

Failed or skipped checks with reasons

• python -m build ./python emits an existing packaging warning about missing README inside python/; build still succeeds. No packaging metadata change included in this PR to keep scope minimal.

Deployment notes

• no deployment changes

Rollback plan

• revert this PR

Manual follow-up checklist

• review existing python/ package README warning separately if you want warning-free sdists

[github-actions]

🤖 Codex PR Review

⚠️ Review skipped: The Codex review could not be completed.

No Codex service URL or API key configured. Set CODEX_AUDIT_SERVICE_URL, ANTHROPIC_API_KEY, or OPENAI_API_KEY.

Please ensure a human reviewer checks this PR before merging.