Fix trusted apply artifacts before redaction

[chubes4]

Summary

Fixes #1837 forward from main after #1839 and #1840.

ArtifactBundleBuilder now writes the canonical patch and changed-files bytes to a workflow-created private temporary apply channel immediately after production mount-diff capture and before ArtifactRedactor transforms configured secret names or values. The workflow applies only validated, bounded canonical files from that channel and removes the root after apply, on normal failure paths, and through the existing exit/signal cleanup coordinator. The channel is outside the durable artifact root and is never added to manifests, reviewer evidence, failure artifacts, or uploads.

Source Relationship

• Source relationship: Fix trusted runner workspace patch application #1839 introduced trusted artifact snapshots and Preserve machine-applicable patches across redaction #1840 preserved redacted durable artifacts; their post-native-CLI snapshot timing cannot retain pre-redaction bytes from the production builder.
• Change kind: narrow runtime lifecycle repair plus production-path integration coverage.
• Verification capability: the integration test executes the real ArtifactBundleBuilder, captureMountDiffs, and ArtifactRedactor, then invokes host apply.
• Scope: only the two canonical apply files are accepted, with existing path containment, regular-file, size, digest, writable-path, seed-identity, and post-apply integrity checks retained. No public schema changes.

Verification

1. npm ci
2. npm run build
3. TMPDIR=/tmp npm run test:redaction
4. TMPDIR=/tmp npm run test:runner-workspace-apply
5. TMPDIR=/tmp npm run test:trusted-apply-artifact-channel
6. npm run test:native-agent-task-lifecycle

The production-path test uses CONFIGURED_SECRET in unchanged patch context. It demonstrates the previous post-redaction artifact is unusable for apply, proves the private pre-redaction bytes apply to the host, and proves the durable patch uses [REDACTED:configured-secret-name].

Compatibility

No public API, schema, or generated changelog changes. Runner-workspace apply now consumes its existing canonical artifacts from a private transient channel; durable/reviewer/uploaded artifact behavior remains redacted under the existing #64 contract.

AI Assistance

Implemented with AI assistance; changes and verification were reviewed and run locally.