fix: prune local security events

Co-authored-by: Codex noreply@openai.com

codex-rs/state/src/runtime.rs

@@ -101,6 +101,8 @@ pub use threads::ThreadFilterOptions;
 // metadata, rather than the exact sum of all persisted SQLite column bytes.
 const LOG_PARTITION_SIZE_LIMIT_BYTES: i64 = 10 * 1024 * 1024;
 const LOG_PARTITION_ROW_LIMIT: i64 = 1_000;
+const SECURITY_EVENT_RETENTION_DAYS: i64 = 10;
+const SECURITY_EVENT_PARTITION_ROW_LIMIT: i64 = 1_000;
 
 #[derive(Clone, Copy)]
 struct RuntimeDbSpec {
@@ -309,6 +311,12 @@ impl StateRuntime {
             thread_updated_at_millis: Arc::new(AtomicI64::new(thread_updated_at_millis)),
             thread_recency_at_millis: Arc::new(AtomicI64::new(thread_recency_at_millis)),
         });
+        if let Err(err) = runtime.run_security_events_startup_maintenance().await {
+            warn!(
+                "failed to run startup maintenance for state db at {}: {err}",
+                state_path.display(),
+            );
+        }
         if let Err(err) = runtime.run_logs_startup_maintenance().await {
             warn!(
                 "failed to run startup maintenance for logs db at {}: {err}",