Report runner workspace integrity changes

[chubes4]

Summary

• report bounded added, modified, and deleted paths when post-verification integrity differs from the approved workspace
• preserve structured integrity evidence in normalized publication failures
• restore the bounded filesystem snapshot fallback for non-Git runner workspaces

Refs #1847.

Evidence

WP Codebox v0.12.26 acceptance run https://github.com/Automattic/build-with-wordpress/actions/runs/29642092608 passes install, build, verify, and drift but reports only an opaque integrity mismatch. A fresh caller reproduction leaves exactly the intended docs change after every verification command, proving the remaining mutation is runtime-side.

How to test

1. Run npm ci && npm run build.
2. Run npm run test:runner-workspace-apply.
3. Run npm run test:native-agent-task-lifecycle.
4. Run npm run test:runner-workspace-publisher.
5. Confirm the integrity test reports extra.txt as added with the structured evidence schema, while the lifecycle test still supports a non-Git fixture workspace.

Compatibility

• No existing public fields are removed or changed. Publication failures gain bounded structured evidence and a more actionable message.
• Non-Git workspaces regain the pre-Ignore Git-excluded files during workspace publication #1845 bounded filesystem behavior; Git workspaces retain tracked plus untracked-nonignored semantics.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol via OpenCode
• Used for: Reproduced the caller verification path, drafted bounded integrity evidence and non-Git fallback coverage, and ran verification with Chris reviewing and owning the change.