Honor optional native task outputs

[chubes4]

Summary

• derive runtime-package required artifacts solely from required output declarations and reject undeclared required names
• support optional {path, required} output projections while preserving string projection compatibility
• retain private runtime-source preparation outside workspace artifact roots and cover a successful no-op with optional output publication

Fixes #1779

Failure evidence: https://github.com/Automattic/build-with-wordpress/actions/runs/29309360438

How to test

1. Run npm run build.
2. Run npm run test:agent-task-contracts.
3. Run WP_CODEBOX_RUN_NETWORK_INTEGRATION=1 npm run test:runtime-sources-playground-integration.
4. Run npm run test:redaction && npm run test:production-boundary-enforcement && npm run test:runtime-tool-policy.
5. Run npm run test:runtime-package-execution && npm run test:php-runtime-package-public-contract.
6. Run actionlint .github/workflows/run-agent-task.yml.

AI assistance

• AI assistance: Yes
• Tool(s): openai/gpt-5.6-terra and OpenCode
• Used for: Implemented the optional artifact/projection contract, source-isolation coverage, documentation, and deterministic verification with Chris Huber directing the task.