Diagnostic bundle files (run.json, identity.json) leak local paths/username that the equivalent history record redacts

[codeforester]

Summary

run.json/identity.json write path fields and argv with no home-directory compaction, unlike the history log which redacts the same kind of fields.

Details

• history.py's build_finished_record/write_primary_record pass project_root, manifest, workspace_root, log_path, bundle_path through compact_optional_path/compact_home_text (history.py:314-334) specifically to replace the caller's home directory with ~.
• lib/python/base_cli/_lifecycle.py:99-114 (RunRecorder._metadata, writes run.json) and lib/python/base_cli/app.py:1288-1297 (identity.json write) write the same fields via plain str(...), with no compaction.
• The recorded argv always includes the real, uncompacted sys.argv[0] — _effective_invocation_argv (app.py:3149-3164) returns the literal sys.argv when no explicit argv is passed, e.g. /Users/alice/.venv/bin/mycli.

Impact

This project's retention/--keep-temp/preserve design exists explicitly to let users share complete diagnostic bundles for support/debugging. run.json inside such a bundle discloses more local-path/username information than the "safe" history log sitting right next to it in the same bundle.

Suggested fix

Route run.json/identity.json path fields (and argv[0]) through the same compact_home_text/compact_path helper already used by history.py.