Validate runner workspace patch base identity

[chubes4]

Summary

Validate runner workspace seed identity before host patch application and retain rejected patch evidence when apply-back fails.

What changed

• Added deterministic content and Git HEAD identity to runner workspace seed snapshots and validated it against the host workspace before mutation.
• Projected rejected patches and changed-files manifests into bounded reviewer-safe workflow uploads for identity mismatch and git apply failures.
• Added executable unit, lifecycle, and Playground E2E coverage for matching success, mismatch rejection before mutation, actual git apply rejection, and complete failure evidence.

How to test

1. Run npm run test:runner-workspace-apply; expect Matching identity applies; mismatched identity and non-applicable patches fail without host mutation and retain evidence descriptors..
2. Run npm run test:native-agent-task-lifecycle; expect Workflow failure envelopes and uploads retain rejected patch and changed-files evidence for identity mismatch and actual git apply rejection..
3. Run npm run test:native-agent-task-playground-e2e; expect The native Playground workflow applies a patch successfully with matching Git-backed seed and host identities..
4. Run npm run test:agent-task-contracts; expect Agent task contracts pass..
5. Run npm run build; expect All packages build successfully..

Compatibility

Additive internal contract change: seed identity is optional in the existing v1 apply request, so existing callers without it retain prior apply behavior. Runner-workspace workflows now fail before mutation on a proven base mismatch and failure uploads gain two bounded reviewer-safe files. No extension paths or public package API are removed or renamed.

Evidence

• CI expected: Build
• CI expected: Test
• Reviewer-resolvable source evidence: Preserve and validate runner workspace patch base identity #1822
• agent-task-contracts: Passed
• apply-contract: Passed
• build: Passed
• lifecycle: Passed
• playground-e2e: Passed

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode general coding and review subagents
• Model: openai/gpt-5.6-sol
• Used for: Traced the native apply-back contract, implemented seed/host identity validation and retained failure evidence, added deterministic regression coverage, and independently reviewed the result; Chris reviews and owns the change.

Source relationships

• Closes Preserve and validate runner workspace patch base identity #1822