Fix quarantine ID collision evidence loss

[cursor]

Bug and impact

scp_utils.quarantine() truncated uuid4() values to the first 8 characters for file names. Two distinct UUIDs with the same prefix wrote to the same {id}.txt / {id}.json pair, silently overwriting earlier quarantine evidence. At scale, that 32-bit namespace creates a realistic evidence-loss path for injection captures and registry/antigen quarantine records.

Root cause

The quarantine ID was generated with str(uuid.uuid4())[:8] and the write path did not check whether the resulting pair already existed.

Fix

Use the full UUID hex value for new quarantine IDs and retry if either the target content or metadata path already exists. Existing 8-character IDs remain listable/purgeable because the purge validator already accepts UUID-like IDs from 1 to 36 characters.

Validation

• RED: PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_quarantine_uses_full_uuid_to_avoid_prefix_collision -q failed on current main with both writes returning aaaaaaaa.
• GREEN/focused: PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py tests/test_registry_ssot.py tests/test_registry_fetch_r4.py tests/test_antigen_p0.py tests/test_antigen_p1_nostr.py tests/test_mcp_contract_v1.py -q -> 81 passed, 1 skipped.
• python3 -m compileall -q src/scp
• git diff --check

  

[ManintheCrowds]

Audit: full UUID hex quarantine ids (no 8-char prefix collision) ported in #60. Closing as superseded by #60.