Allowlist native agent-task uploads

[chubes4]

Summary

• stage only normalized request/result/native input, result-referenced declared artifacts, compact runtime provenance, and an exclusion manifest
• exclude raw source trees and source files without aborting normalized failed-result uploads; reject source artifacts explicitly declared for review
• upload only the staged root, including its hidden .codebox contents

Closes #1774

Evidence

• Reproduces the raw layout from run 29306539573: source content caused upload preparation to fail after native execution, leaving only the request artifact.

How to test

1. Run npm run build.
2. Run npm run test:agent-task-contracts.
3. Run npm run test:redaction.
4. Run npm run test:runtime-sources-playground-integration (the pinned network integration is skipped locally unless WP_CODEBOX_RUN_NETWORK_INTEGRATION=1).
5. Run npm run test:production-boundary-enforcement.
6. Run actionlint .github/workflows/run-agent-task.yml.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: Investigated the referenced GitHub Actions run, implemented the upload allowlist and regression coverage, and ran deterministic checks.