Preserve and validate runner workspace patch base identity

[chubes4]

Problem

Native runner workspace apply-back can receive a patch based on content other than the checked-out host workspace. git apply --check correctly rejects it, but the current failure envelope and uploaded artifacts omit the rejected patch, changed-files manifest, seed identity, and host identity needed to identify where the baseline diverged.

Observed in Build with WordPress: https://github.com/Automattic/build-with-wordpress/actions/runs/29506404162

The caller correctly selected the technical maintenance package with success_requires_pr=false. Native execution then failed at host apply-back:

Host git apply failed: error: patch failed: docs/contributor-workflows.md:142
error: docs/contributor-workflows.md: patch does not apply

The Actions host checkout was 58630e6384e34c8ddffeda160e18df24b7956693. The uploaded result contains only the apply error; it does not retain the canonical patch or the baseline identity used to produce it.

Ownership

WP Codebox owns patch generation/apply-back and the workflow artifact projection. Docs Agent supplies runner workspace policy; Agents API does not generate or apply this patch.

Related prior work: #1784, #1785, #1788, #1790.

Acceptance

• Seed snapshots carry a deterministic source identity, including target Git HEAD when available and a content digest.
• Apply-back validates expected seed identity against the actual host workspace before mutation.
• Identity mismatch fails before mutation with expected and actual identity in the failure envelope.
• Host apply failure retains the rejected patch and changed-files manifest in uploaded evidence.
• Deterministic tests prove matching seed/host apply succeeds and mismatched seed/host fails before mutation with complete evidence.
• The Build with WordPress maintenance workflow can be rerun with enough evidence to identify and repair any remaining producer-side baseline divergence.