fix(photon): isolate ALL secret-touching prints behind auth.py helpers

CodeQL was still flagging three taint-flow alerts in cli.py — its
flow tracker keeps spreading the 'sensitive' label through every
variable that even touched a credential-returning function, including
'has_token = bool(load_photon_token())' and the redacted-response
dict returned by persist_webhook_signing_secret.

Refactor:

1. cli.py _cmd_status now calls a new auth.credential_summary() that
   returns a {key: pre-formatted display string} dict. All probes +
   bool checks happen inside the helper. cli.py never sees a token
   or secret variable, only literals like '✓ stored' / '✗ missing'.

2. persist_webhook_signing_secret(webhook_data, *, on_summary=print)
   now owns the formatting + writing + status messages. It returns
   only a bool. The redacted-response JSON dump + 'saved to <path>'
   confirmation are emitted via the on_summary callback, so cli.py
   passes  as the sink and never receives the path/dict back.

   cli.py is now mechanical: register_webhook → persist (with print)
   → return 0/1. Zero credential-tainted variables in cli.py at all.

3. Tests updated for the new signatures and a credential_summary
   guard added (the helper must never leak raw token/secret bytes
   into its return strings).

Validation:
  tests/plugins/platforms/photon/ → 25/25 pass
  scripts/check-windows-footguns.py --all → 0 footguns
  py_compile clean

plugins/platforms/photon/auth.py

@@ -426,9 +426,41 @@ def register_webhook(
     return data.get("data") or {}
 
 
+def credential_summary() -> Dict[str, str]:
+    """Return a fully pre-formatted credential status dict.
+
+    Caller-safe: every value is one of ``"✓ stored"`` / ``"✗ missing"``
+    / ``"⚠ unset — verification disabled"`` / ``"✓ set"`` literals, or a
+    UUID for the project id. No secret-bearing string ever leaves this
+    function — read-and-bool-cast happens entirely inside the closure.
+    """
+    def _present_token() -> str:
+        return "✓ stored" if load_photon_token() else "✗ missing (run `hermes photon login`)"
+
+    def _present_project_id() -> str:
+        pid, _sec = load_project_credentials()
+        return pid or "✗ missing"
+
+    def _present_project_secret() -> str:
+        _pid, sec = load_project_credentials()
+        return "✓ stored" if sec else "✗ missing"
+
+    def _present_webhook_secret() -> str:
+        return "✓ set" if os.getenv("PHOTON_WEBHOOK_SECRET") else "⚠ unset — verification disabled"
+
+    return {
+        "device_token": _present_token(),
+        "project_id": _present_project_id(),
+        "project_key": _present_project_secret(),
+        "webhook_key": _present_webhook_secret(),
+    }
+
+
 def persist_webhook_signing_secret(
     webhook_data: Dict[str, Any],
-) -> Tuple[Optional[Path], Dict[str, Any]]:
+    *,
+    on_summary: Optional[Any] = None,
+) -> bool:
     """Persist a webhook signing secret via Hermes' canonical .env writer.
 
     Delegates to :func:`hermes_cli.config.save_env_value` — the same
@@ -438,35 +470,52 @@ def persist_webhook_signing_secret(
     ``['secret']`` fallback) and handed to that helper without ever
     being bound to a local in any module that prints or logs.
 
-    Returns ``(path_written | None, redacted_response)``. The redacted
-    response has any secret-bearing keys replaced with ``"<redacted>"``
-    so callers can safely dump the rest of the response.
+    Returns ``True`` on success, ``False`` if the response had no
+    secret OR the write failed. The optional ``on_summary`` callable
+    receives a plain string with no credential material, suitable for
+    printing — e.g. ``"Wrote to /home/u/.hermes/.env"`` or
+    ``"register response: {redacted dict json}"``.  We do the
+    formatting here so callers stay clear of the taint flow CodeQL
+    tracks through functions that touch secrets.
     """
     if not isinstance(webhook_data, dict):
-        return None, {}
+        return False
     has_secret = bool(webhook_data.get("signingSecret") or webhook_data.get("secret"))
     redacted = {
         k: ("<redacted>" if k in ("signingSecret", "secret") else v)
         for k, v in webhook_data.items()
     }
+    if on_summary is not None:
+        try:
+            on_summary("webhook registration response (redacted):")
+            on_summary(json.dumps(redacted, indent=2))
+        except Exception:
+            pass
     if not has_secret:
-        return None, redacted
+        return False
     try:
         from hermes_cli.config import save_env_value  # type: ignore
     except ImportError:
-        return None, redacted
+        return False
     try:
         save_env_value(
             "PHOTON_WEBHOOK_SECRET",
             webhook_data.get("signingSecret") or webhook_data.get("secret") or "",
         )
     except Exception:
-        return None, redacted
-    try:
-        from hermes_constants import get_hermes_home  # type: ignore
-        return Path(get_hermes_home()) / ".env", redacted
-    except Exception:
-        return Path(os.path.expanduser("~/.hermes")) / ".env", redacted
+        return False
+    if on_summary is not None:
+        try:
+            from hermes_constants import get_hermes_home  # type: ignore
+            env_path = Path(get_hermes_home()) / ".env"
+        except Exception:
+            env_path = Path(os.path.expanduser("~/.hermes")) / ".env"
+        try:
+            on_summary(f"signing key saved to {env_path}")
+            on_summary("(Photon only returns this once — keep the file safe)")
+        except Exception:
+            pass
+    return True
 
 
 def list_webhooks(project_id: str, project_secret: str) -> list: