Preserve verification failure evidence

[chubes4]

Summary

• retain bounded sanitized stdout and stderr tails for failed verification and drift commands
• attach successfully applied patch and changed-file descriptors when later verification fails
• stage those artifacts through the existing reviewer-safe apply-failure upload policy

Root cause

Docs Agent maintenance runs applied their patches and passed every repository check, then failed the completion validator. WP Codebox projected only the command exit code and discarded both the validator diagnostic and the applied diff, making the failure impossible to classify from GitHub Actions artifacts.

Reproductions:

• https://github.com/Automattic/agents-api/actions/runs/29739294675
• https://github.com/Automattic/build-with-wordpress/actions/runs/29739272354

How to test

1. Run npm run test:native-agent-task-lifecycle.
2. Run npm run test:native-agent-task-interruption.
3. Run npm run test:agent-task-workflow-interface.
4. Run actionlint .github/workflows/*.yml.
5. Confirm the lifecycle fixture exposes failed command tails and stages sanitized patch/change evidence without changing successful result projections.

Compatibility

This adds reviewer evidence only on failed verification or drift commands. Successful workflow result projections and artifact paths remain unchanged. No extension interface is removed or renamed.

Closes #1889

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with GPT-5.6-sol
• Used for: Diagnosed two hosted failures and implemented the generic evidence projection and deterministic coverage with Chris reviewing and owning the change.