Fix trusted runner workspace patch application

[chubes4]

Resolves #1837

Summary

• Snapshot canonical patch and changed-files artifacts into a bounded, private temporary root before host application.
• Apply only from that byte-preserving snapshot, then remove it before durable artifact redaction.
• Redact bounded UTF-8 durable artifacts, including patch text, without decoding binary artifacts.

Source Evidence And Scope

• Source relationship: follows the runner workspace seed identity/integrity boundary introduced by Validate runner workspace patch base identity #1823 and the existing artifact/upload redaction family.
• Change kind: narrow runtime boundary fix plus deterministic lifecycle regression coverage.
• Verification capability: the fixture sets MODEL_PROVIDER_SECRET_1=OPENAI_API_KEY; that value is unchanged diff context, so redacting the apply input makes git apply fail while the trusted snapshot succeeds. It also asserts the durable patch and uploaded apply-failure patch are redacted.
• Scope rationale: only canonical codebox-patch and codebox-changed-files refs are copied, each remains a bounded regular file, and applyRunnerWorkspacePatch still performs its existing digest, path, seed identity, changed-file, and post-apply integrity checks.

Compatibility Impact

No public API or artifact schema changes. Runner workspace application behavior is unchanged except it now remains applicable when a configured secret value occurs in unchanged patch context. Durable artifacts are more strictly redacted.

Fresh Checkout Verification

1. git clone https://github.com/Automattic/wp-codebox.git && cd wp-codebox
2. npm ci
3. TMPDIR=/tmp npm run test:runner-workspace-apply
4. TMPDIR=/tmp npm run test:redaction
5. npm run test:native-agent-task-lifecycle
6. TMPDIR=/tmp npm run build

TMPDIR=/tmp keeps tsx IPC socket paths below the platform limit in deeply nested checkout paths.

Validation

• TMPDIR=/tmp npm run test:runner-workspace-apply
• TMPDIR=/tmp npm run test:redaction
• npm run test:native-agent-task-lifecycle
• TMPDIR=/tmp npm run build

Release Notes

CHANGELOG.md is intentionally unchanged; release automation generates it.

AI Assistance

GPT-5.6 assisted with codebase tracing, the temporary-artifact primitive, and regression-test drafting. The resulting diff and focused commands were reviewed and executed in this checkout.