Deepen fresh-execution release gate (deferred from #6)

[ElbertePlinio]

Follow-ups deferred from the PR for #6 (clean-replay grading). None block the v1.0 rigor bar; #6 already makes clean-replay THE grading path and the gate fail-closed on missing/mismatched provenance. These harden it further.

Deferred hardening (from the #6 review panel: Opus + GLM + codex-sol)

• gradingMode independent cross-check. The gate trusts the self-reported gradingMode: 'clean_replay' string. Now mitigated by enforcing agentWorkspaceIsolation.restrictedPathsAbsent, but there is no fully independent post-hoc proof a separate grading dir was used. Consider recording + asserting the grading path differs from the agent-workspace path.
• TOCTOU in hidden-fixture leak check. _hiddenFixtureIsolation probes the agent workspace after the run; an agent could in principle read + delete a leaked fixture before the probe. Primary defense (_shouldExcludeWorkspacePath never assembles _hidden into the agent workspace) is solid, so this is defense-in-depth. Fix: snapshot the workspace file manifest before the agent runs and diff post-run.
• Full-bundle digest drift. The gate cross-checks the hidden-verifier digest subset against live bundles, but not the full taskBundleDigest. Evaluator-visible (non-hidden) fixture drift goes undetected. Lower risk than hidden-verifier drift.
• Minor dedup. release_report.dart _stringMapEquals vs leaderboard_exporter.dart _mapEquals are near-identical.

Pre-existing flaky test (unrelated to #6, found while validating)

• test/agent/agent_harness_test.dart — MinimalAgentHarness bounds command output expects AgentRunStatus.failure on output flood but races to success. Fails deterministically in isolation on main (3/3), passes in the full parallel suite. Make the flood deterministic (sustained output that always trips the bound before completion).

[ElbertePlinio]

Two more deferred items from PR #31 round 4:

• Infra-aware workspace-isolation gate (Codex P1, comment 3559881952): a release-gate signal that the agent workspace contained no genuine restricted-content leak (reference/author_notes/task_qa), while excluding benchmark infra (.git, .dart_tool, prepare outputs) that made the naive restrictedPathsAbsent check regress in round 1. Defense-in-depth — those paths are never assembled into the agent workspace and are stripped from grading, so there is no known live leak vector today.

[ElbertePlinio]

Deferred from PR #31 round 5 (Codex P2 3559993629 + 3559993635): scope the fresh-execution + frozen-manifest validation to the exported leaderboard rows/trials rather than every resultProvenance entry / the full corpus manifest. Only matters for mixed codegen+agentic runs exported per-track; the current official path is agentic-only (--preset mvp) so single-track exports validate exactly their own rows. Include the manifest-vs-taskRows track filtering there too.

[ElbertePlinio]

More deferred from PR #31 final round:

• Full public-bundle digest drift (Codex P1 3560105593): cross-check each frozen selectedTasks/result taskBundleDigest against the live taskBundleDigestEvidence (already computed by the release CLI), not just the hidden-verifier subset. Catches a public bundle changing between run and release while hidden tests stay identical.
• Combo-set exactness (Codex P2 3560105606): verify resultProvenance contains each planned (taskId, providerId, modelId, trialIndex) combo exactly once, not just matching length (a duplicate can currently mask an omitted combo).