fix(bindings): canonicalize runtime mount replay keys

[chaliy]

Motivation

• Prevent reset() from restoring mounts that were explicitly unmounted via an equivalent normalized path by ensuring replay logs use canonical VFS paths.

Description

• Normalize VFS paths when recording and forgetting runtime mounts in the JS binding by canonicalizing vfs_path before comparing or storing it (crates/bashkit-js/src/lib.rs).
• Apply the identical normalization change to the Python binding's runtime mount log functions (crates/bashkit-python/src/lib.rs).
• Add regression tests that mount using a non-canonical path then unmount the canonical equivalent and call reset() for both JS and Python to cover the bug (crates/bashkit-js/__test__/runtime-extension.spec.ts, crates/bashkit-python/tests/test_runtime_extension.py).
• Update the threat-model entry TM-ISO-025 to document the capability-resurrection risk and its mitigation (knowledge/security/threat-model.md).

Testing

• Ran cargo fmt --all -- --check (passed).
• Ran cargo check -p bashkit-js -p bashkit-python (passed) and cargo test -p bashkit-js -p bashkit-python --lib (unit/lib tests passed).
• Ran just check-okf (OKF linting passed).
• Added JS ava and Python pytest regressions; pytest collection failed in this environment because the bashkit Python package was not installed, and the JS ava case could not run here because napi/node_modules tooling is not present (napi/pnpm not available). These tests are included in the repo and should pass in CI where build tooling is available.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	a56f38a	Commit Preview URL	Sep 01 2026, 09:11 AM