fix: enforce server trust boundaries

tools/thothctl/internal/serverops/operations_test.go

@@ -131,6 +131,41 @@ func TestMigrateSessionsFailsClosedBeforeMutation(t *testing.T) {
 	}
 }
 
+func TestMigrateSessionsReturnsTypedBoundedRunFailure(t *testing.T) {
+	installation := testInstallation(t)
+	secret := "database-password-in-stderr"
+	configCalls := 0
+	runner := &fakeRunner{run: func(args []string) (compose.Result, error) {
+		switch {
+		case contains(args, "ps", "--all"):
+			return compose.Result{Stdout: `[]`}, nil
+		case contains(args, "config", "--format", "json"):
+			configCalls++
+			return compose.Result{Stdout: `{"services":{"core":{"image":"thothii-core:local"},"session-migrate":{"image":"thothii-core:local"}}}`}, nil
+		case contains(args, "run", "--rm", "--no-deps", "--no-TTY", "session-migrate"):
+			return compose.Result{Stderr: "TLS connection for " + secret + ": " + strings.Repeat("x", 2048), ExitCode: 23}, errors.New("exit status 23")
+		default:
+			t.Fatalf("unexpected Docker invocation: %#v", args)
+			return compose.Result{}, nil
+		}
+	}}
+
+	_, err := MigrateSessions(context.Background(), installation, runner, true)
+	var operationErr *OperationError
+	if !errors.As(err, &operationErr) {
+		t.Fatalf("MigrateSessions() error = %T %v, want OperationError", err, err)
+	}
+	if operationErr.Stage() != StageSessionMigration || operationErr.Class() != ExitClassNonzero {
+		t.Fatalf("operation error = %#v", operationErr)
+	}
+	if detail := operationErr.Detail(); !strings.Contains(detail, secret) || len(detail) > 512 {
+		t.Fatalf("bounded detail length=%d value=%q", len(detail), detail)
+	}
+	if configCalls != 2 {
+		t.Fatalf("config calls = %d", configCalls)
+	}
+}
+
 func TestRemovePreservesEveryDeclaredBindSecretAndBackup(t *testing.T) {
 	installation, preserved := removalInstallation(t)
 	psCalls := 0