fix(cluster): guard substring slice + redact join credentials in logs

[ArangoGutierrez]

Summary

• Add length guard before CACertHash[:32] to prevent panic on truncated openssl output
• Redact bootstrap token and certificate key from log output

Audit Findings

• Multiple enhancements #3 (HIGH): Substring panic on short CACertHash
• Set default container runtime name when non is specified and Container-Toolkit is reuqested #19 (MEDIUM): Credentials logged in plain text

Changes

• pkg/provisioner/cluster.go: Length guard + log redaction for join credentials

Test plan

• gofmt — no formatting issues
• go build — compiles
• go test ./pkg/... — all tests pass

[Copilot]

Pull request overview

This pull request addresses two audit findings related to the cluster provisioning code:

1. HIGH severity: Prevents a potential panic when slicing CACertHash if the openssl output is truncated
2. MEDIUM severity: Redacts sensitive join credentials (bootstrap token and certificate key) from log output

Changes:

• Added length guard before substring slicing to prevent panic on short CA cert hash
• Redacted bootstrap token from logs (changed from plaintext to [REDACTED])
• Redacted certificate key from logs (removed the partial display)

[coveralls]

Pull Request Test Coverage Report for Build 21963025628

Details

• 0 of 6 (0.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.04%) to 47.465%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
pkg/provisioner/cluster.go	0	6	0.0%

Totals
Change from base Build 21955389842:	-0.04%
Covered Lines:	2500
Relevant Lines:	5267

---

💛 - Coveralls