Add threat model and debugging comments for code reviewers

[assisted-by-ai]

Summary

This PR adds clarifying comments throughout the codebase to document threat model assumptions and debugging practices for code reviewers.

Key Changes

• derivative-maker: Added comments explaining that verbose logs (set -x) are preferred for build debugging, and that secret leak prevention should be handled at the CI/environment level rather than by disabling trace output
• help-steps/variables: Added threat model comment clarifying that command line arguments are considered trusted in derivative-maker
• help-steps/variables: Added threat model comment clarifying that files on the file system are considered trusted
• help-steps/pre: Added threat model comment clarifying that command line arguments are considered trusted in the exception_handler_retry() function

Implementation Details

These are non-functional documentation comments added to critical sections of the build system to help reviewers understand the security assumptions and design decisions:

• The comments establish that the build system operates under a threat model where command-line inputs and filesystem sources are trusted
• The comments justify the use of verbose logging (set -x) for debugging purposes and clarify that secret protection is a CI/environment responsibility

https://claude.ai/code/session_01PYxHMF7ChedHCqqrmoqhAQ

[ArrayBolt3]

I don't think this is all that useful. The comments are accurate, but the places they're being put make no sense to me.

The command line is considered trusted because it is input from the end-user. Files on the filesystem are considered trusted at the time derivative-maker or derivative-update runs; the user is expected to have verified the Git repo integrity using manual PGP verification or similar before running either script. The only time where trust matters in the derivative-maker codebase is when running derivative-update - the files present on the filesystem when derivative-update runs are considered trusted, but the files that are being fetched from upstream are not trusted until they have been cryptographically verified. This means that derivative-update must never run git checkout until after it has verified whatever ref it is about to check out. That may be something good to audit.

The bit about verbose logs being preferred for build debugging is maybe useful for AI reviewers I guess, but I don't think it's useful to humans. I don't think we have any secrets that are involved in the CI (@adrelanos correct me if I'm wrong here), so I don't think the secret leak prevention comment is useful either.)