Canonicalize reviewer evidence before sanitization

[chubes4]

Summary

• Canonicalize native transcript references before runtime-result sanitization, using realpath containment, no symlink traversal, byte digests, and a single relative reviewer-evidence descriptor.
• Make upload staging consume and revalidate only the dedicated descriptor.
• Cover hosted duplicate refs, distinct transcripts, stale digests, and reviewer-safe transcript projection.

Fixes #1795

Regression evidence: https://github.com/Automattic/build-with-wordpress/actions/runs/29350690551

Testing

1. npm run build
2. npm run test:agent-task-contracts
3. npm run test:runtime-sources-materialization
4. npm run test:native-agent-task-lifecycle
5. npm run test:native-agent-task-interruption
6. npm run test:native-agent-task-playground-e2e
7. npm run test:redaction
8. npm run test:production-boundary-enforcement
9. actionlint .github/workflows/run-agent-task.yml .github/workflows/agent-task-contracts.yml

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: Implemented the canonical reviewer-evidence boundary, added regression coverage, and ran verification with Chris Huber.