Preserve machine-applicable patches across artifact redaction

[chubes4]

Problem

Runner-workspace publication can deterministically fail when an unchanged patch context line contains the name of a configured secret. Artifact redaction rewrites that identifier before the canonical patch reaches host application, so git apply receives a patch that no longer matches the byte-identical target workspace.

Observed in Build with WordPress manual Docs Agent acceptance:

• Workflow run: https://github.com/Automattic/build-with-wordpress/actions/runs/29602656672
• Failed job: https://github.com/Automattic/build-with-wordpress/actions/runs/29602656672/job/87958279897
• Result artifact: https://github.com/Automattic/build-with-wordpress/actions/runs/29602656672/artifacts/8415650116
• Target HEAD: 2e26a61da8a6148c80a0211f9839996be3817b77
• Expected and actual content digest were both 29348b2d39d8371d18dee0067dbae045a0e378c735b9b3800370dd69105eed26.
• Failure: Host git apply failed: patch failed: docs/contributor-workflows.md:151.

The rejected patch replaced an existing literal secret identifier in an unchanged context line with [REDACTED:configured-secret-name]. The target checkout still contained the original identifier, so the redacted patch could not apply. The agent otherwise produced the intended documentation correction.

Root cause

packages/runtime-playground/src/artifact-bundle-builder.ts constructs files/patch.diff by passing the canonical workspace patch through ArtifactRedactor. ArtifactRedactor registers configured secret names as literal replacements. packages/runtime-core/src/runner-workspace-apply.ts subsequently treats that reviewer-safe redacted artifact as the machine-applicable canonical patch.

This conflates two contracts:

1. A byte-preserving internal patch used for trusted host application.
2. A redacted reviewer/upload artifact safe for durable publication.

Acceptance criteria

1. Host application consumes a byte-preserving patch whose context still matches the verified seed identity.
2. Reviewer-facing and uploaded artifacts retain secret redaction; no configured secret values leak.
3. Any unredacted apply material is transient, bounded to the trusted apply path, and absent from uploaded/durable artifacts.
4. Deterministic coverage modifies a file whose unchanged patch context contains a configured secret name, then proves host apply and publication preparation succeed.
5. Existing artifact-redaction and runner-workspace integrity tests remain green.

Reproduction

1. Configure a runtime secret named OPENAI_API_KEY.
2. Mount a tracked repository containing the literal text OPENAI_API_KEY in a line adjacent to an intended edit.
3. Produce a sandbox edit so the literal appears as unchanged patch context.
4. Apply the emitted canonical patch through applyRunnerWorkspacePatch.
5. Observe that the artifact contains [REDACTED:configured-secret-name] and git apply rejects it against the unchanged seed.

[chubes4]

The merged implementations in #1840 and #1839 do not reach the production redaction boundary. Both call createTrustedArtifactSnapshot() in execute-native-agent-task.mjs only after agent-task-run returns. In production, packages/runtime-playground/src/artifact-bundle-builder.ts has already passed files/patch.diff through ArtifactRedactor before the CLI returns, so the snapshot contains the same non-applicable [REDACTED:configured-secret-name] context that caused the original failure.

The lifecycle regression uses a fake CLI that writes an unredacted patch directly into .codebox/agent-task-artifacts; it bypasses ArtifactBundleBuilder and therefore cannot prove the real fix.

Fix-forward acceptance must exercise the production artifact builder/redactor path and prove all of the following in one integration:

1. The trusted host-apply input remains byte-applicable when configured secret names occur in unchanged context.
2. Durable/reviewer/upload patch artifacts still redact configured secret names and values.
3. Unredacted apply material is transient and absent after the trusted apply boundary.
4. The test fails against current main, where post-runtime snapshotting is too late.

Merged commits under review: a9f16a392256fc93f52332b8b6973794f34f2231 and duplicate 694554150dcd7ccc802471b8b846e1513476a092.