security: separate Campaign reader and operator data

tests/test_response_security.py

@@ -129,7 +129,11 @@ def test_version_response_omits_source_base_path_and_sanitizes_summaries() -> No
         created_at=_now(),
         updated_at=_now(),
         validation_summary={"campaign_file": "/tmp/campaign.json", "ok": True},
-        build_summary={"messages": [{"eml_path": "/tmp/message.eml", "subject": "Public"}]},
+        build_summary={
+            "build_token": "internal-build-token",
+            "smtp_transport_revision": "internal-smtp-revision",
+            "messages": [{"eml_path": "/tmp/message.eml", "subject": "Public"}],
+        },
         execution_snapshot_hash=None,
         execution_snapshot_at=None,
     )
@@ -141,6 +145,13 @@ def test_version_response_omits_source_base_path_and_sanitizes_summaries() -> No
     assert payload["validation_summary"] == {"ok": True}
     assert payload["build_summary"] == {"messages": [{"subject": "Public"}]}
 
+    operator_payload = CampaignVersionResponse.model_validate(
+        version,
+        context={"include_diagnostics": True},
+    ).model_dump()
+    assert operator_payload["build_summary"]["build_token"] == "internal-build-token"
+    assert operator_payload["build_summary"]["smtp_transport_revision"] == "internal-smtp-revision"
+
     detail = CampaignVersionDetailResponse.model_validate(
         SimpleNamespace(
             **version.__dict__,
@@ -200,6 +211,8 @@ def test_ordinary_job_detail_and_attempts_do_not_expose_diagnostics() -> None:
 
     assert "eml_local_path" not in job_payload
     assert "eml_storage_key" not in job_payload
+    assert "claimed_at" not in job_payload
+    assert "smtp_started_at" not in job_payload
     assert job_payload["attachments"] == [{"filename": "public.pdf"}]
     assert "claim_token" not in attempts["smtp"][0]
     assert "claim_token" not in attempts["imap"][0]