[Security/Performance] Make session evidence collection bounded and privacy-safe

[juancarlosrodicio]

Problem

The evidence collector mixes private session content with output that defaults inside the repository and materializes large inputs multiple times:

• `opencode/scripts/collect-session-evidence.mjs:18-57` accumulates complete sqlite JSON query results in memory.
• `opencode/scripts/collect-session-evidence.mjs:318-320` reads every raw session JSON file in full.
• `opencode/scripts/collect-session-evidence.mjs:602-617` joins all normalized rows and execution trees into large strings before writing them.
• The default output is `docs/ai/evolution/runs//raw` (`opencode/scripts/collect-session-evidence.mjs:96-100`), but the public ignore rules do not ignore that path.
• The generated data includes source paths, workspace directories, model/provider data, prompts/summaries, and `raw_path` (`opencode/scripts/collect-session-evidence.mjs:264-360`).

The documentation calls raw evidence private, but the command does not enforce that boundary.

Impact

A normal collection run can retain sensitive prompts, local paths, provider metadata, and session content in an easy-to-stage directory. A later public sync can therefore leak private evidence. Large databases or raw sessions can also cause high memory use and disk spikes because the collector holds query results, normalized rows, trees, and serialized output simultaneously.

Suggested direction

• Default private collection output to a mode-0700 temporary/state directory outside the Git worktree, or refuse an in-worktree output unless an explicit private-output flag is supplied.
• Separate private raw staging from sanitized publishable artifacts; remove or pseudonymize absolute paths, model/provider fields, prompts, summaries, and raw file paths from publishable output.
• Stream sqlite/raw rows and JSONL writes, enforce per-file/per-session/total byte limits, and terminate child processes when limits are exceeded.
• Add an explicit metadata-only mode for audits that do not need content.
• Add a repository ignore rule as defense in depth, while keeping the runtime boundary authoritative.

Acceptance criteria

1. Default output cannot be accidentally staged as public evidence.
2. Publishable artifacts contain no absolute local paths, provider/model metadata, prompts, or raw source paths.
3. Large inputs are processed with bounded memory and deterministic size-limit errors.
4. Tests cover private-output refusal, redaction, output caps, and interrupted/partial collection cleanup.