artifacts: capture diffs for repo-backed workspace edits

[chubes4]

Problem

WP Codebox repo-backed workspace mounts need reliable diff capture after sandbox agents mutate files through DMC workspace_write or workspace_edit.

During live fan-out, artifact bundles sometimes contained empty changed-files.json and patch.diff even when the agent attempted edits or reported intended changes. For fleet replacement, Codebox must produce a trustworthy patch artifact from the mounted workspace copy.

Desired shape

For each repo-backed workspace mount, artifact collection should compare the final mounted workspace against its baseline copy and emit:

• Changed files list.
• Unified patch per workspace.
• Optional full changed file snapshots.
• Diagnostics when diff extraction fails.
• Provenance tying paths back to workspace mount metadata.

Layer boundary

WP Codebox owns baseline/final mounted workspace comparison because it creates the disposable workspace copy and artifact bundle. DMC owns the in-sandbox file edit tools. Homeboy consumes the resulting artifact.

Acceptance criteria

• workspace_write and workspace_edit mutations show up in changed-files.json and patch.diff.
• Empty patches are distinguishable from failed diff extraction.
• Diff extraction works without requiring git inside WordPress Playground.
• Artifacts preserve workspace slug/path provenance for promotion.

Related work

• fix: hide git-backed patch tool in sandbox #425 moved git-backed patch application out of the sandbox safe tool set.
• Normalize mounted workspace paths in workspace tools Extra-Chill/data-machine-code#505 made mounted workspace path/edit calls work in DMC.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafting this issue from the live fan-out artifact behavior.