fix(security): cap lease registry, gate startup-execution settings, harden egress (#828)