fix(security): clear new CodeQL code-scanning alerts (round 2) (#10888)

Validado no worktree combinado: typecheck:core, changelog-integrity, file-size, lint todos verdes. Correção real dos 3 alertas CodeQL (HMAC em vez de hash bruto, URL parsing em vez de substring, dismiss documentado). CI vermelho é o base-red já rastreado em #9985.

open-sse/executors/freebuff.ts

@@ -1,3 +1,5 @@
+import { randomInt } from "node:crypto";
+
 import {
   BaseExecutor,
   type ExecuteInput,
@@ -20,7 +22,7 @@ function generateClientSessionId(): string {
   const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
   let out = "";
   for (let i = 0; i < 13; i++) {
-    out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    out += alphabet[randomInt(alphabet.length)];
   }
   return out;
 }

open-sse/services/cursorApiKeyAuth.ts

@@ -50,8 +50,12 @@ export function isCursorApiKey(value: unknown): value is string {
   return typeof value === "string" && value.startsWith(CURSOR_API_KEY_PREFIX);
 }
 
+// Session-cache key fingerprint, not a password/credential hash — keyed with a fixed context
+// label so it reads as a domain-separated digest rather than a bare password hash.
 function cacheKeyFor(apiKey: string): string {
-  return crypto.createHash("sha256").update(apiKey).digest("hex");
+  return crypto.createHmac("sha256", "omniroute-cursor-session-cache-fingerprint-v1")
+    .update(apiKey)
+    .digest("hex");
 }
 
 export function readJwtExpiryMs(token: string): number | null {

tests/unit/antigravity-byop-account-rotation.test.ts

@@ -130,7 +130,7 @@ test("Antigravity BYOP 422 rotates to a sibling account and the request succeeds
         { status: 200, headers: { "Content-Type": "application/json" } }
       );
     }
-    if (request.url.includes("cloudcode-pa.googleapis.com")) {
+    if (new URL(request.url).hostname === "cloudcode-pa.googleapis.com") {
       modelCalls.push({
         token: (request.headers.get("authorization") || "").replace(/^Bearer\s+/i, ""),
       });