fix(ci): preserve runtime JavaScript and isolate native export source

[schlessera]

Refs #2126. Closes #2271. Closes #2275. Successor to merged #2178; neither issue is claimed complete.

What changed

The native diagram export fixture runs unchanged SVG/PNG/PDF operations from a fresh private copy of tracked source, with exact workspace resolution and fresh configuration roots. A private preload refuses core-command dispatch and checks a zero-attempt receipt for each export. Proof discovery also resolves existing explicit JavaScript runtime files before neighboring TypeScript declarations, preserving actual Bun TypeScript fallback when JavaScript is absent.

Why this shape

The archive excludes stale build output and untracked JavaScript shadows while retaining six actual workspace domains and locked external dependencies. Immutable preparation requires the complete owned domain to match HEAD. Each invocation validates bytes, modes, canonical paths, guards and installed workspace aliases. No production CLI seam, provider permission, selected case or artifact assertion changes.

Proof

Head 0ab89b7 (test fixture successor to 53abd2d), based on actual #2178 squash ef6945f.

• Strict types pass; focused proof/source regression: 61 tests / 354 assertions pass.
• Actual pinned offline Chromium/WebKit diagrams: 10 files / 178 cases pass, including unchanged 76 native export cases and exact raster, font and PDF assertions. Immutable archive: exact head / 847 tracked inputs.
• JavaScript/declaration failing first: four named discovery/activation/importer assertions failed while actual Bun executed the JavaScript reader. Two additional failures were source-pin drift from ongoing caller work, not this defect. All focused cases pass after repair. Missing runtime, symbolic paths, type-only imports and actual Bun source-extension fallback have separate controls.
• Native dispatch mutation retained export arguments but selected the actual doctor callback: NATIVE_EXPORT_CORE_COMMAND_ACTIVATED fails. Root/config and ambient executable controls fail named guards. Corrupting all four fonts fails the existing embedded-families assertion; corrupting one unused weight survived and is not claimed red.
• Archive byte/mode/path/guard mutations and missing installed workspace aliases refuse. A private-source probe completes all formats without original workspace source mounted.
• Required check:pr passed at this frozen head: metadata, lint/leakage, workflow, environment and changeset checks; 949 fast tests / 6304 assertions; 176 import-graph feedback tests / 1478 assertions. A malformed browser selection was stopped before the authoritative complete 178-case run. A shell quoting mistake started a duplicate preflight; that duplicate was stopped, preserving the original run.

Checklist

• Complete selected hosted proof passed.
• Remaining criteria are explicit below.
• Milestones read back before merge.
• Repository-only test/proof tooling; no shipped package change or changeset.
• No machine contract or provider-history change.

Anything left open

The whole browser category remains fresh. The truthful inventory has 307 cases, while retained Worker metadata remains the older 305-case audit. Exact native producer, generated artifact/reference document and source materializer have not been admitted as a closed retained capability. No unknown is waived and no retained hit is claimed.

Independent bounded source review found no blocking issue for this preparation slice. Archive completeness relies on trusted preparation; external dependencies are linked rather than independently rehashed by this materializer. Both remain qualification obligations. A three-format kernel file diagnostic passed after the draft checkpoint, but is not counterfactual/static proof; four unknown-child-exit warnings remain recorded. Coordinator review resumed under claim p02126-native-resume-20261017. The prior bounded review missed two existing wrapper test files; that regression is now corrected and verified below.

Remaining #2126 work: complete exact-operation imports/callbacks and active-initialization audit; include all tracked producer inputs in immutable identity; prove activation/resource mutations; qualify current complete Worker boundary; obtain actual same-PR fresh browser shards and whole-success aggregate; demonstrate equivalent follow-up retention with independent validation, bounded API use and no proof chains. Existing run receipts remain preserved. A ready-for-review request is not proof until its selected jobs complete.

Wrapper fixture correction after bounded review

#2275 preserves the separate actual hosted project-list failures and new copied-module setup regression. At 53abd2d the two existing wrapper files report 1 pass / 16 fail because the copied runner lacks its new preparation dependency. These module-load failures are not counted as causal guard mutation proof.

The two test files now copy the real preparation dependencies, use a tiny owned tracked Git fixture where the actual source preparer executes, and explicitly expect both existing diagram projects. No production source, selected project, assertion, source pin or native export fixture changed in this correction. All 17 cases / 58 assertions pass. Removing only diagrams-chromium from actual default selection causes four named forwarding assertions to fail; restored exact runner bytes pass all 17. Strict types pass. Required check:pr on this successor passes 949 fast tests / 6304 assertions and 193 graph-feedback tests / 1536 assertions across 21 files. The unchanged actual native producer retains its earlier exact-source 178-case receipt; no new hosted success is inferred.

Fresh readback: historical #2178 confirmation 38970927775 and actual main 38971608455 completed with failures. Existing #2262 covers unhealthy-versus-shutdown; #2275 covers wrapper fixture expectations; separately filed hosted timeout observations preserve their unknown causes. Neither failed workflow qualifies as a retention baseline. Draft feedback 38977075237 intentionally skipped expensive categories, and its successful aggregate is not selected final confirmation.