Validate tuning inputs; remove dead pass block (audit fixes #989)

- _prompt() clamps non-positive tuning values to default with operator warning
  (HIGH from AUDIT_SEC_989: prevents garbage display when vars file has
  masscan_rate: -100 or nuclei_concurrency: 0)
- Remove empty 'if scan_mode in (...): pass' placeholder left from refactor
  (P3 from AUDIT_CODE_989)
- Add AUDIT_CODE/SEC/ENV_989.md and FIXES_989.md with skip justifications
  (path traversal not applicable to single-operator threat model;
  Tor wording already adequate; estimate disclosure interactive-only)

audits/AUDIT_ENV_989.md

@@ -0,0 +1,61 @@
+---
+agent: env-validator
+status: PASS
+timestamp: 2026-05-02T00:00:00Z
+findings_count: 0
+errors: []
+---
+
+# Env Validation — DevTrack #989
+
+## Summary
+Comprehensive secrets hygiene audit for webrunner estimator rewrite (provider_rates.py and deploy_webrunner.py). **All checks passed.**
+
+## PASS
+
+### Secrets in source
+- **provider_rates.py**: Clean. Contains only tuning constants (rate tables, timing defaults, cost multipliers). No API keys, tokens, passwords, or credential patterns detected.
+- **deploy_webrunner.py**: Clean. Contains no hardcoded secrets. All credential handling is delegated to provider-specific utilities (linode_utils, aws_utils, flokinet_utils) which retrieve secrets from Infisical at runtime.
+
+### API key/token patterns
+Searched all files for:
+- `ghp_[A-Za-z0-9_]+` (GitHub tokens) — NOT FOUND
+- `sk_live_[A-Za-z0-9]+` or `sk_test_[A-Za-z0-9]+` (Stripe) — NOT FOUND
+- `AKIA[A-Z0-9]{16}` (AWS access keys) — NOT FOUND
+- `Bearer [A-Za-z0-9._-]{20,}` (bearer tokens) — NOT FOUND
+- `password\s*=\s*["'][^"']{8,}` (hardcoded passwords) — NOT FOUND
+- `api[_-]?key\s*=\s*["'][^"']{10,}` (API keys) — NOT FOUND
+
+### .env file content
+- No new .env files created in either module
+- No .env file writes detected in code
+- Tuning parameters stored in safe yaml configs:
+  - `inputs/targets.yaml` — target definitions, probe patterns, vulnerability tags only
+  - `inputs/countries.yaml` — country codes, priority levels, exclude lists only
+  - User-supplied vars files (optional) — only tuning parameters (masscan_rate, nmap_timing, hit_rate, etc.)
+
+### Credential handling verification
+All provider credentials properly retrieved from Infisical:
+- **Linode**: `creds get LINODE_TOKEN homelab` (linode_utils.py:16-19)
+- **AWS**: `creds get AWS_ACCESS_KEY_ID homelab` and `creds get AWS_SECRET_ACCESS_KEY homelab` (aws_utils.py:17-24)
+- Fallback to vars file templates only (marked as placeholders like 'YOUR_AWS')
+- No secrets persisted to disk; only set in `os.environ` in memory (deployment_engine.py:set_provider_environment)
+
+### Git history check
+- No secrets in recent commits to these files
+- 16 commits to webrunner module examined (latest: "Phase-accurate webrunner cost/time estimator...")
+- Notable commit: "Fix P1 WEBRUNNER deployment failures and secret leakage" (18039b2) — prior leak was addressed and fixed
+- No secret patterns detected in any commit
+
+### Code review
+- `provider_rates.py` (209 lines): Pure computation — estimate_scan_hours(), build_estimate_table(), formatting helpers. No file I/O, no env var access.
+- `deploy_webrunner.py` (617 lines): Parameter gathering and deployment orchestration. All secrets retrieved via subprocess calls to `creds` binary (lines 16-24 in provider utils). No new credential handling code introduced in this rewrite.
+
+## Findings
+**0 issues.**
+
+No hardcoded secrets, no .env writes, no credential handling added. Secrets flow:
+```
+User input → provider_utils → creds binary (Infisical) → os.environ (memory only)
+```
+This is correct per secrets management rules.