Use WP Codebox v0.12.21 reviewer projection

[chubes4]

Summary

Update Docs Agent to released WP Codebox v0.12.21, which projects reviewer-safe uploaded workflow results for the hosted proof.

Source Relationship

• Source issue: Automattic/wp-codebox#1814
• Source implementation: Automattic/wp-codebox#1815
• Hosted proof: Automattic/agents-api run 29468956857
• Related Docs Agent run PR: Automattic/agents-api#430

Change Kind

• Small consumer pin update: reusable workflow call, matching wp_codebox_release_ref, validation checkout, and release fixture now use v0.12.21 / 0.12.21.
• Documents the reviewer-safe workflow-result projection: public control/publication fields and canonical transcript provenance remain; raw runtime_result, outputs.engine_data, model/provider/tool payloads, source content, private paths, and secrets are excluded.
• Adds a deterministic producer contract assertion for the projection allowlist and exclusions.
• Historical diagnostic and upload regression run IDs remain unchanged; only the release-specific hosted-proof run is updated.

Verification

Fresh checkout after fetching the declared immutable package revision required by source-integrity validation:

1. WP_CODEBOX_DIR="$PWD/.wp-codebox" php tests/validate-wp-codebox-run-agent-task-contract.php
2. php tests/validate-docs-agent-packages.php
3. php tests/validate-external-native-package-sources.php
4. php tests/repair-docs-links-smoke.php

All passed. The validation checkout uses the released v0.12.21 producer contract.

Backwards Compatibility

No Docs Agent workflow-input or reusable-workflow-output change. The producer preserves its internal workflow result and public outputs; only its uploaded reviewer copy is intentionally narrower. Consumers that incorrectly read raw runtime/provider/model/tool content from that uploaded artifact must use the canonical sanitized transcript or declared public projections.

Scope

This repository has no runtime implementation change. Its consumer pin, documentation, fixture, and contract assertion are limited to the upstream v0.12.21 evidence. The producer continues to reject runtime-source content in declared artifacts and other staged files.

AI Assistance

• AI assistance: Yes
• Tool: OpenCode
• Model: OpenAI gpt-5.6-sol
• Used for: inspected upstream contract evidence, updated consumer pins and documentation, added the bounded contract assertion, and ran validation.