bug: adversarial checkpoint snapshot is orphaned from artifact manifest

[chubes4]

Severity

Medium: a successful adversarial run produces a bundle that fails WP Codebox's own artifact verifier.

Environment

• WP Codebox 0.18.0
• Playground adapter 0.18.0
• Playground CLI 3.1.46
• Run ID: run_35552ed2c2c241198cd354aee9ce8c30
• Runtime ID: runtime-ms9e8oaf-er7o0u
• Seed: community-impossible-oracle-control-260

Reproduction

1. Run a small adversarial campaign with resetPolicy.mode=checkpoint-per-case and replay selection findings.
2. Confirm the campaign succeeds and writes a finding/replay.
3. Run:

wp-codebox artifacts verify --bundle <runtime-bundle> --json

Expected

The successful bundle verifies, and every generated checkpoint/snapshot file is represented in manifest.json.

Actual

Verification fails:

{
  "valid": false,
  "violations": [{
    "code": "orphaned-file",
    "path": "files/runtime-snapshots/snapshot-ms9e8ygz-29gn6o.json",
    "message": "Bundle file is not listed in manifest.json"
  }]
}

Impact

• Breaks artifact integrity guarantees for checkpoint-backed campaigns.
• Makes an otherwise valid oracle-sensitivity control bundle unsuitable for transfer/review.
• Replay exists, but the parent evidence bundle cannot be trusted as verifier-clean.

Evidence

• Bundle: /mnt/extrachill-workspace/tmp/opencode/community-posting-fuzz-cc5e8b0-control-artifacts/runtime-ms9e8oaf-er7o0u
• Campaign result: files/adversarial/impossible-oracle-control/result/adversarial-campaign-result.json
• Replay: files/adversarial/impossible-oracle-control/replay/6c23a4b07676fbb794bcd7a9c688748747ef70ae98ca79841b0ae59c752959d9.json
• Orphan: files/runtime-snapshots/snapshot-ms9e8ygz-29gn6o.json

Suggested ownership layer

WP Codebox artifact manifest finalization for runtime checkpoint/snapshot files.