feat: release passwordless hierarchical APT v1.2.5

docs/security/2026-08-security-baseline.md

@@ -16,3 +16,7 @@
 - Synthetic sentinel credentials only in tests.
 - Work remains on the isolated hardening branch until review gates pass.
 - No feature additions until Critical/Important security closure.
+
+## Accepted passwordless proxy exception
+
+Zac explicitly requires the paired-extension **Connect → select camera → Start Proxy** flow without re-entering Alta credentials. The external `aware-cam-proxy.exe` helper supports cookie authentication only through `-k`; it exposes no stdin, named-pipe, environment-variable, or credential-file interface. APT therefore passes the validated main-owned session directly to the fixed helper as one argv value. This exception remains bounded by direct `shell: false` spawn, trusted-device allowlisting, no renderer/IPC credential parameter, no logs/files/shells, redacted launch errors, safe tracked metadata, and synthetic regression tests.