Summary

• seed enabled runner workspaces as disposable copy-on-write /workspace recipe inputs with a baseline
• expose and enforce sandbox-local workspace tools, then validate and apply canonical captured patches on the host
• publish validated changes through a narrowly scoped GitHub REST publisher after verification and drift checks

Closes #1784
Related: #1783
Run: https://github.com/Automattic/wp-codebox/actions/runs/29311239264

Testing

1. Run npm run build.
2. Run npm run test:native-agent-task-lifecycle.
3. Run npm run test:runner-workspace-apply && npm run test:runner-workspace-publisher.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: Implemented the copy-on-write workspace lifecycle, deterministic tests, and documentation for review.