Summary

• recursively sanitize private runtime-source paths from result values, keys, diagnostics, stacks, command arguments, metadata, and textual uploads
• retain reviewer-useful typed runtime-source provenance while removing source_package_root
• preserve failed result status and diagnostics, reject actual prepared source files/directories, and add hosted-run regressions

Fixes #1772

Hosted failure: https://github.com/Automattic/build-with-wordpress/actions/runs/29305012941

How to test

1. Run npm run build.
2. Run npm run test:agent-task-contracts.
3. Run npm run test:agent-task-runtime-package-staging.
4. Run npm run test:redaction.
5. Run npm run test:production-boundary-enforcement.
6. Run npm run test:runtime-tool-policy.
7. Run WP_CODEBOX_RUN_NETWORK_INTEGRATION=1 npm run test:runtime-sources-playground-integration.
8. Run actionlint .github/workflows/run-agent-task.yml .github/workflows/agent-task-contracts.yml.

Backwards compatibility

• Result and upload payloads no longer expose private runtime source paths or source_package_root; public typed runtime provenance remains available.

AI assistance

• AI assistance: Yes
• Tool(s): openai/gpt-5.6-terra and OpenCode
• Used for: Implemented the sanitizer, regression fixtures, and verification with Chris's requested scope.