Capture declared verification command artifacts

[chubes4]

Summary

Allow successful verification and drift commands to produce bounded, declared, reviewer-visible artifacts without adding caller-specific semantics to WP Codebox.

What changed

• Extend verification and drift command entries with optional name, type, and artifact-relative path declarations.
• Validate authorization, containment, symlinks, file type, size, UTF-8, sanitization, and immutable digest before publication.
• Stage accepted artifacts through the existing declared-artifact allowlist and revalidate digests during upload.

How to test

1. Run npm run test:native-agent-task-lifecycle; expect Verification and drift artifact success/failure, ordering, tamper, and upload integration cases pass..
2. Run npm run test:agent-task-contracts; expect Reusable workflow, canonical evidence, interface, runtime-source, and request contract suites pass..
3. Run npm run build; expect Runtime core, Playground, and CLI TypeScript builds pass..

Compatibility

Additive reusable-workflow request support. Existing verification and drift entries remain compatible; artifact validation applies only when an artifact is declared.

Evidence

• Base unchanged since verification: main remains at bc98294.
• CI expected: WP Codebox CI
• Durable run execution: PartialFailure
• Reviewer-resolvable source evidence: Capture declared artifacts produced by runner verification commands #1887
• Verified finalization base: main at bc98294
• gate-1: Passed
• gate-2: Passed
• gate-3: Passed

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode
• Model: openai/gpt-5.6-sol
• Used for: Designed and implemented generic declared artifacts from verification and drift commands, including containment, sanitization, integrity, upload, and regression coverage; Chris reviewed and owns the change.

Source relationships

• Closes Capture declared artifacts produced by runner verification commands #1887