chore: capture all the envelopes

[bitsandfoxes]

do not merge. this is just harvesting envelopes.

#skip-changelog

[sentry-warden]

SENTRY_AUTH_TOKEN can leak through captured Linux Breakpad minidumps

Capture-mode desktop jobs still expose the real SENTRY_AUTH_TOKEN to the integration-test process. The Linux Breakpad crash test can include that inherited environment in its minidump, which is stored verbatim and uploaded in downloadable envelope artifacts; unset or replace the token during capture mode.

Evidence

• .github/workflows/test-run-desktop.yml places secrets.SENTRY_AUTH_TOKEN in job-level env, so the Linux Breakpad test process inherits it even when SENTRY_DSN points to the local capture server.
• Integration.Tests.ps1 skips Sentry API validation in capture mode but does not remove SENTRY_AUTH_TOKEN; the Linux matrix explicitly runs the breakpad backend.
• envelope-capture-server.py writes multipart minidump request bodies directly to test/IntegrationTest/envelopes/, and test-run-desktop.yml uploads that directory; ci.yml subsequently merges the artifacts into envelopes-all without redaction.
• Linux Breakpad minidumps capture the crashed process environment, allowing the inherited authentication token to become part of the uploaded artifact.

_{Identified by Warden · security-review · WM6-GS9}

[sentry-warden]

Fix attempt detected (commit 2f6508a)

Capture mode and artifact handling were refactored, but test-run-desktop.yml still exposes the real SENTRY_AUTH_TOKEN at job scope and Integration.Tests.ps1 never unsets or replaces it before launching the Linux Breakpad process.

The original issue appears unresolved. Please review and try again.

_{Evaluated by Warden}

[sentry-warden]

Fix attempt detected (commit 8c913b7)

The commit reworked capture mode and made it opt-in, but capture jobs still pass the real SENTRY_AUTH_TOKEN into test-run-desktop and never unset or replace it before Linux Breakpad processes can include it in minidumps.

The original issue appears unresolved. Please review and try again.

_{Evaluated by Warden}

[sentry-warden]

Fix attempt detected (commit b996a28)

The commit refactors capture mode and makes it opt-in, but Linux desktop capture jobs still pass SENTRY_AUTH_TOKEN at job scope and never unset or replace it before running Breakpad, so the token can still enter uploaded minidumps.

The original issue appears unresolved. Please review and try again.

_{Evaluated by Warden}

[sentry-warden]

Fix attempt detected (commit 8c6e216)

The commit adds capture-mode handling and routes desktop envelopes to local artifacts, but test-run-desktop.yml still exports the real SENTRY_AUTH_TOKEN unconditionally, so Linux Breakpad minidumps can still capture and expose it.

The original issue appears unresolved. Please review and try again.

_{Evaluated by Warden}

[sentry-warden]

Fix attempt detected (commit 50be50c)

The capture workflow was refactored and made opt-in, but capture-mode desktop jobs still pass the real SENTRY_AUTH_TOKEN into the test process and never unset or replace it, so Linux Breakpad minidumps can still contain the token.

The original issue appears unresolved. Please review and try again.

_{Evaluated by Warden}

[sentry-warden]

Capture artifacts expose the Sentry auth token used by Android symbol uploads

When capture mode is enabled, Android passes the real SENTRY_AUTH_TOKEN to sentry-cli; the proguard upload reaches the capture server, which stores its authentication headers in .meta.json files that are then published in a 14-day corpus artifact accessible to artifact readers.

Evidence

• test-build-android.yml enables SENTRY_CAPTURE_PATH for capture runs while injecting secrets.SENTRY_AUTH_TOKEN into the Unity container; ci.yml forwards the manual capture-corpus input to this workflow.
• build-project.ps1 changes only SENTRY_URL in capture mode, while CliConfiguration reads the real token and SentryCli.CreateSentryProperties writes it as auth.token for Gradle uploads.
• Android builds force minification, and DebugSymbolUpload registers upload-proguard using sentry.properties; this request is not handled by the capture server's /chunk-upload/ or /assemble/ branches.
• The capture server's general POST handler persists dict(self.headers) in each .meta.json, and test-build-android.yml uploads test/IntegrationTest/capture/ with retention-days: 14.

_{Identified by Warden · security-review · 7XE-Q2X}