fix(ci): keep Docker proof bind sources stable across runs

[schlessera]

Refs #2376

What changed

Docker-based local proofs now bind stable checkout-owned directories and select invocation files inside the container. Native-host, identity, lease and capture callers keep their existing assertions and security flags. Captures publish atomically on the destination filesystem. Native diagram export transports private source and captured runtime bytes through tar-filled named volumes and copies results out, preserving host-state/canary absence checks.

Why this shape

Docker Desktop retains shares keyed by host bind sources. Reusing stable sources bounds further growth. Diagram source isolation needs private inputs, so it uses the copy/volume form permitted by #2376. The implementation changes local proof transport; no runtime qualification pins, product isolation settings or timing budgets are changed.

Proof

Historical draft checkpoint: 6cc530a7acb8abd3cfec796a28ee72a3e6d56f34; integrated main: c4d31c6bd1aeed60fd3cda02f9c8586fe8a509ae; tree: 27d9b66065f9fd0d53ade446d18b3c7dea5982cf.

Refreshed real Docker receipts below executed source 16c9ed01b32c2ec7630111ec079a6c1669703b16, based on delivered #2375. The subsequent main advance changes CI headroom/sharding metadata; native/capture implementations, package sources and their runtime inputs are unchanged. These remain receipts for their actual executed source, not executions on the later SHA.

Caller	Desktop shares before / first / second	Result
Real pinned lease	15 / 15 / 15	both pass
Complete native host	15 / 18 / 18	both pass
Complete default identity	18 / 19 / 19	both pass
Private diagram export, both engines	19 / 19 / 19	both pass

Native-host includes Claude/Pi × UID 1000/0, the intended retained-index negative/recovery, unchanged namespace quota and full owned loop/mount/backing cleanup. Both identity runs use complete scope, all four default app/control phases, existing SDK/prepared-consumer/Btrfs controls, no skipped categories and confirmed container/resource cleanup. Optional projection byte/write controls and five named bind-source failing-first/mutation receipts are retained in #2376.

Complete capture verification passes twice (362.08 / 368.87 s), each with five recipes, 13 exact files and ten paint-history pairs. The raw global counter increases 19 / 26 / 39 during concurrent foreign-workspace proof activity; that aggregate measurement remains failed evidence. Mount-root inspection finds one share per stable source in this checkout, with no duplicates. A bounded diagnostic repeats complete verification with transparent Docker argv logging and before/after mount IDs: pass in 375.12 s, 39 / 39 total shares, eight / eight owned checkout shares, zero new mounts. Seven Docker run calls use five stable bind sources and no fresh staging/runner bind paths. This attributes the global interference without changing comparisons or guards.

• Historical build and strict types pass at the recorded draft checkpoint. Its six focused suites pass 73 tests / 229 assertions; lint/leakage and citation checks pass.
• All original containment, source/canary absence, read-only inputs, network, cleanup and atomic-output assertions remain intact. AppArmor is unavailable locally; no enforced AppArmor qualification is claimed.
• Initial refreshed diagram copy failed ENOSPC with only 1.3 GiB available. Failed evidence is retained. Removing only regenerable installs in this campaign's completed worktrees restored capacity; both unchanged diagram runs then pass.
• Historical preflight at e6f1716 passes 956 fast tests and 176 affected tests, with one frozen-native-positive failure owned by ci: native diagram qualification self-test rejects legitimate source drift #2365. Complete current preflight and hosted candidate confirmation remain pending; no known-failed guard or qualification hash is waived/refreshed.

Current local candidate — 2026-10-19

Head 5da13f8c7dc1e02281a37d7e8f577632786a26e2, integrated base and preflight merge base 90a95123cfceb169bd2ecf7c213544db742eaed7, tree b088ad82d16c481c3bcfd021f6c2135fcfb57584. This conflict-free, nonrewriting integration preserves the original implementation and historical receipts. The diff remains 12 files, 251 insertions and 51 deletions. Main's frozen-positive correction and draft-proof gate are integrated; measured native/capture implementations and their runtime inputs are unchanged from 16c9ed01b32c2ec7630111ec079a6c1669703b16. Those earlier measurements remain historical executions, not runs on this head.

• The actual bun run check:pr --base origin/main exits 0 in 203.15 seconds: all lint/leakage, environment and changeset gates pass, 959 fast tests / 6,354 assertions pass, and 189 import-graph feedback tests / 53,369 assertions pass. Feedback includes the real pinned lease-container test and complete corrected native frozen-positive/current-source controls. No test selection, offline guard, deadline, image or assertion changes were made.
• The pinned browser image was already installed at the declared digest; no pull occurred. The lease fixture uses its existing network-disabled container and cleanup. No loop/Btrfs/identity container or repeated five-caller mount campaign ran in this continuation. The earlier resource restriction was resolved before execution; it was not a test failure.
• Own frozen copyfile dependencies use a fresh private cache. All 59,516 regular installed files have link count 1, and no dependency symlink escapes the owned checkout. Installation identity is 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245. Lockfile SHA-256 remains 5bbd5f6651f111db3fcfabeda512d44a21163cba54c58993f8878012d548cc14.
• Earlier checks on this same unchanged candidate pass strict types, lint/leakage, and 19 focused route-free offline tests / 51,830 assertions. The actual complete preflight above is a separate receipt. No consumer-visible package change or changeset is required.
• The recorded planner selects all hosted proof categories. Complete selected hosted proof is still required. Current local success does not qualify a later base or substitute for actual selected-job checkout, resource and aggregate evidence.

Checklist

• Complete local preflight passed for the exact candidate recorded above.
• Complete selected hosted candidate proof passed; actual checkout identities verified.
• Scoped native/capture behavior, mutation and cleanup evidence is recorded.
• PR and issue release milestone: 0.44.0.
• Local tooling only; no consumer-visible release change or changeset.
• Leakage, docs/citations, machine surface and append-only provider history constraints preserved.

Anything left open

#2365 is delivered by PR #2374, squash 90a95123cfceb169bd2ecf7c213544db742eaed7. Keep draft under Refs pending complete selected hosted confirmation for the final candidate. The parent campaign owns confirmation and merge windows, actual requested base/head/selected-job checkout reconciliation, current reviews/milestones and matching-head merge/main closure checks. #2376 remains open. Per-new-worktree stable-path mounts remain explicitly outside this issue's scope. Historical raw runtime logs were not located during the bounded recovery search; the published receipt narratives above and in #2376 remain attributed to their original executions.