feat(agent): record observed fs writes into the side-effect lane (#465 Phase A, 2/5)

[AminChirazi]

Part 2/5 of #465 Phase A. Stacked on #468 — merge that first, then retarget/merge this.

What

Promotes the Linux seccomp filesystem observation from stderr-only report to a recorded fs_write side effect. The stderr report (report_fs, issue #302 behavior) is unchanged. FsEvent gains a structured path2 rename destination (retiring the ambiguous "src -> dst" join at capture), AgentRun gains observed, and the lane builder routes every path through a total hygiene function: the only path-bearing output is a ./-prefixed workspace-relative name (no component rewritten); traversal (..) forms, outside-workspace, and unanchored-relative paths all redact to a sha256: 12-hex note — never normalized-and-kept, so a symlinked .. cannot misattribute an outside write as a workspace file. The lane joins the assert_no_secret_leak store-guard corpus before the trace is minted (invariant 9). docs/agent-testing.md owns the reversal of the previously-declined fs lane, naming #465 as the human act and keeping the original objection verbatim.

Notes for review

• Compiler-forced literal edits only in existing tests (path2: None, observed: false); no assertion changed. Hand-rolled deterministic property tests (4000 cases), no new dev-dependency.
• Escalation — dependency reading: flowproof-cli now names sha2 0.10 as a direct dependency (needed for the mandated redaction hashes; already in the build graph via pdf-extract -> lopdf, zero new lockfile packages, never in public API). If "no new public dependency" is read as "no new direct Cargo.toml entry at all", please say so and we substitute.

Evidence

fmt 0 · clippy 0 · cargo test --workspace 0 · Linux cross-check 0 · ratchets.sh exit 0, diff 400/400.

🤖 Generated with Claude Code