Harden wolfTrust service isolation and recovery

[aidangarske]

F-14097, F-14098, F-14096, F-14111, F-14114, F-14104, F-14112, F-14118, 
F-14124, F-14125, F-14119, F-14122, F-14123, F-14095, F-14109, F-14126, 
F-14127, F-14108, F-14101, F-14102, F-14120, F-14121, F-14117, F-14107, 
F-14099, F-14100, F-14106

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #22

Scan targets checked: wolftrust-src, wolftrust-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #22

Scan targets checked: wolftrust-src, wolftrust-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved HSM fault cleanup, vault-removal contract, and test-coverage issues block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• HSM fault leaves in-flight guest requests blocked · New

Resolved since last review (1)

• Retire tasklets after guest reinitialization failure

Previously missed (1)

In code that hasn't changed since last review

Remove operation can delete key objects

include/​wolftrust/​services/​vault_service.h:34

This newly changed contract is incorrect: WT_VAULT_OP_REMOVE still looks up any matching vault object and calls wh_Nvm_DestroyObjectsChecked, so it can delete key objects as well as storage objects. The key backend explicitly documents the separate key-destroy path because the storage-face remove has different label semantics (src/services/native/keyvault.c:549-571); restore the previous comment or change the implementation to reject WT_VAULT_FLAG_KEY.