Add threat model and debugging comments for code reviewers

[assisted-by-ai]

Summary

This PR adds clarifying comments throughout the codebase to document threat model assumptions and debugging practices for code reviewers.

Key Changes

• derivative-maker: Added comments explaining that verbose logs (set -x) are preferred for build debugging, and that secret leak prevention should be handled at the CI/environment level rather than by disabling trace output
• help-steps/variables: Added threat model comment clarifying that command line arguments are considered trusted in derivative-maker
• help-steps/variables: Added threat model comment clarifying that files on the file system are considered trusted
• help-steps/pre: Added threat model comment clarifying that command line arguments are considered trusted in the exception_handler_retry() function

Implementation Details

These are non-functional documentation comments added to critical sections of the build system to help reviewers understand the security assumptions and design decisions:

• The comments establish that the build system operates under a threat model where command-line inputs and filesystem sources are trusted
• The comments justify the use of verbose logging (set -x) for debugging purposes and clarify that secret protection is a CI/environment responsibility

https://claude.ai/code/session_01PYxHMF7ChedHCqqrmoqhAQ