feat: bind records to stable input and candidate snapshots (E03)

[TheAmericanMaker]

Closes #401.

core/engineering/snapshots.ts turns what a host observed into the snapshot identity E01 defined. Pure: the host walks the tree, this normalizes, excludes, orders, and judges coverage.

The rule that shapes it: identity must not silently overstate what was observed.

• coverage is inside the digest, so a capture that quietly narrowed cannot look identical to a fuller one.
• An unreadable or host-skipped file becomes an uncovered_relevant_input rather than an omission, and a non-empty list blocks acceptance — the collector knows it did not look at something relevant, so an unchanged digest cannot mean an unchanged tree.
• A secret file is excluded by name and its digest is never recorded (a digest of a credential file is still an oracle for it); the exclusion is disclosed so partial coverage is visible.
• stability stays outside the digest, so re-capturing an unchanged tree is not mistaken for an edit.
• Same HEAD with changed working bytes is a different identity: dirty-tree evidence cannot be replaced by a revision.

diffSnapshots explains what moved, including coverage drift a manifest diff would hide. It complements checkCandidateFreshness rather than replacing it.

Second commit: six bypasses found in review

An independent adversarial review (a63fa75) found the module validated paths and inputs after deciding what to do with them, and that its own gate repeated the defect E01 was corrected for twice:

Finding	Effect
Path checked after exclusion/secret matching	/home/x/.netrc, ../../.npmrc, NUL paths recorded raw inside the digest
coverage?.… ?? [] in the gate	Omitting coverage returned ok:true — a degradation that raised trust
Duplicate check after the unreadable branch	One path both fingerprinted and uncovered
patternCovers missed *.log, **/*.log	Exclusions disclosed but never applied
Only secrets deduped	One rule declared twice changed an identical tree's identity
repository passed through	Arbitrary keys and a string dirty reached the identity

All six closed and regression-tested.

Verification

RED first (13 failures before the barrel export). 20/20 focused, 993/993 full suite, build exit 0, git diff --check clean. Fourteen mutation checks each turn the suite red.

Registered snapshots.ts in E01's module-graph test at the same layer as validation.ts, and widened its pure-import allowlist to ../secrets.ts so both surfaces withhold the same files; secrets.ts is itself pure.

[TheAmericanMaker]

Second adversarial review (Fable 5.1) — three more collisions, all closed in b9c43b2

The first review's fixes were themselves reviewed. Three more ways two different trees reach one digest, plus three spurious-drift bugs:

Finding	Observed	Fix
executable coerced	executable: 1 and executable: false both digested 8d7b8e822812 — a script with the executable bit was indistinguishable from one without	non-booleans refused
Non-total sort order	compareUtf8 encodes to UTF-8, mapping unpaired surrogates to U+FFFD, so "a\uD800" and "a\uFFFD" compared equal; same tree in two enumeration orders → c2ce6fbcf849 vs 3f3c2eba3f2d	such paths/patterns refused
String(head)	head: ["a".repeat(40)] accepted and digested as an array; non-plain prototype threw instead of returning ok:false	shape-checked
Exclusion dedup by pattern +reason	re-declaring a built-in rule under host-declared gave a second coverage entry and a second identity for an identical tree	deduped by pattern; conflicting reason is an error
** supported	empties the manifest — two unrelated trees both digested 1b912bb41278, gate still passed	refused
Finding 4 survived in two shapes	bare directory name disclosed but matched nothing inside it; *.log and **/*.log disagreed on a file named .log	both spellings require a non-empty stem and agree

The executable coercion is the same class as the repository fix in a63fa75 — the first pass fixed the instance, not the rule. That's the lesson worth keeping: when a review finds a coercion, sweep every coercion.

Test honesty: four tests were weaker than their titles. The secret test now greps the entire serialized result including dropped (not just coverage), and the exclusion test asserts a matching file really leaves the manifest.

Verification: 26/26 focused, 999/999 full suite, build exit 0, git diff --check clean. Seven new mutation checks bite. An eighth candidate guard turned out to be unreachable — isRepoRelativePath already refuses * — and was removed rather than shipped as dead code that looks load-bearing.