fix(14.2): WR-06 gate checks the seed secret stays private

The self-test feeds a planted token line through dev-stack.sh redact-seed
and refuses when the secret survives; --e2e refuses unless
tmp/dev-stack/seed.out has mode 600.

scripts/check-phase14.2.sh

@@ -296,6 +296,15 @@ run_self_test() {
 		return 1
 	fi
 
+	# The seed's minted API token secret never reaches the terminal (WR-06).
+	local redacted
+	redacted="$(printf '%s\n' 'user: created' 'api token: created inv_selftestSecret-0123 (shown once)' |
+		env -i PATH="$PATH" HOME="$HOME" bash "$DEV_STACK" redact-seed)"
+	if grep -q 'inv_selftestSecret' <<<"$redacted" || ! grep -q '^api token: created' <<<"$redacted" || ! grep -q '^user: created$' <<<"$redacted"; then
+		echo "refuse: self-test redact-seed did not hide the token secret: $redacted" >&2
+		return 1
+	fi
+
 	# Go log scan (T-14.2-20) and summaries.
 	local dir
 	dir="$(mktemp -d)"
@@ -527,6 +536,7 @@ run_e2e() {
 		trap 'bash "$DEV_STACK" down || true' EXIT
 	fi
 	bash "$DEV_STACK" up --detach
+	seed_out_private
 	bash "$DEV_STACK" guard
 	bash "$DEV_STACK" e2e "${GATE_SPECS[@]}"
 	echo "e2e (report only, D-15): ${REPORT_SPECS[*]}"
@@ -536,6 +546,21 @@ run_e2e() {
 	echo "phase14.2 e2e passed"
 }
 
+# seed_out_private refuses unless tmp/dev-stack/seed.out, which can hold a
+# minted API token secret, is readable by its owner only (WR-06).
+seed_out_private() {
+	local file="$APP/tmp/dev-stack/seed.out" mode
+	[[ -f "$file" ]] || {
+		echo "refuse: $file not found" >&2
+		return 1
+	}
+	mode="$(stat -c '%a' "$file")"
+	[[ "$mode" == 600 ]] || {
+		echo "refuse: $file has mode $mode, want 600 (it can hold an API token secret)" >&2
+		return 1
+	}
+}
+
 run_all() {
 	local stage
 	for stage in self-test go docs parity contracts guard e2e; do