Upload canonical sanitized agent transcripts

[chubes4]

Summary

• stage one normalized codebox-transcript ref under the trusted artifact root, independent of package artifact declarations
• sanitize and upload the bounded transcript at a stable path with source provenance and staged SHA-256
• exclude declared source aliases and prove source/symlink paths cannot escape the upload boundary

Fixes #1791.

Hosted evidence

• Original hosted no-op run: https://github.com/Automattic/build-with-wordpress/actions/runs/29344070545

How to test

1. Run npm run test:runtime-sources-materialization.
2. Run npm run test:redaction.
3. Run npm run test:agent-task-contracts.
4. Run actionlint .github/workflows/run-agent-task.yml.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode with openai/gpt-5.6-terra
• Used for: Implemented the uploader boundary, tests, and contract documentation with Chris's requested requirements.