Git-aware workspace snapshots include mutable .codebox control artifacts

[chubes4]

Problem

WP Codebox v0.12.25 correctly excludes Git-ignored dependency artifacts during runner-workspace publication, but its Git-aware snapshot now includes untracked .codebox runtime control files when the target repository does not independently ignore that directory. Those files mutate after approval, so publication fails with Runner workspace changed after approval; refusing publication.

Evidence

• Acceptance run: https://github.com/Automattic/build-with-wordpress/actions/runs/29627878516
• Uploaded result: https://github.com/Automattic/build-with-wordpress/actions/runs/29627878516/artifacts/8424487221
• WP Codebox v0.12.25 was selected.
• Dependency installation, build, verification, and scoped drift all passed.
• The target repository ignores node_modules/ but does not ignore .codebox.

Root cause

PR #1845 replaced recursive workspace traversal with git ls-files --cached --others --exclude-standard. The previous traversal explicitly skipped .codebox, but the replacement relies only on repository ignore rules. Runtime-owned .codebox files therefore enter snapshots in repositories that do not declare that internal exclusion.

Expected behavior

• .codebox remains an unconditional runtime-control exclusion from publication and integrity snapshots.
• Git tracked and untracked-nonignored workspace files continue to define publishable content.
• Tests prove mutable .codebox state does not invalidate an approved patch, while publishable changes and symlinks still fail closed.

[chubes4]

WP Codebox v0.12.26 acceptance still fails integrity after install, build, verify, and drift all pass: https://github.com/Automattic/build-with-wordpress/actions/runs/29642092608

A fresh local reproduction applied the known docs/contributor-workflows.md correction and ran the exact pnpm install --frozen-lockfile, pnpm build, and pnpm verify sequence. git status --short --untracked-files=all remained exactly the intended docs modification after every command. The caller does not mutate publishable content.

The remaining blocker is that verifyRunnerWorkspaceIntegrity() reports no changed-path evidence, and the publication catch drops structured error evidence. The next upstream repair should report bounded added/modified/deleted paths and preserve that evidence in the normalized workflow result so the runtime-owned mutation can be fixed deterministically.

[chubes4]

Acceptance on v0.12.27 confirms the original mutable .codebox integrity failure is repaired: install, build, verify, scoped drift, integrity verification, commit, branch update, and PR publication all succeeded in https://github.com/Automattic/build-with-wordpress/actions/runs/29663992711. The run published commit a21e3428daa34933e04d0c29521b93412accabea to Automattic/build-with-wordpress#121.

The workflow remained red only after publication due two separate contract defects: case-sensitive canonical repository URL validation in WP Codebox and Docs Agent projecting a nonexistent top-level publication URL. Those are being tracked independently.