fix(artifacts): accept the bundle subject when extracting an app bundle (#891)

* fix(artifacts): accept the bundle subject when extracting an app bundle

For a .app target the session target is the bundle's executable, while the
artifact provider reports the bundle itself as the subject. The subject
check exempted inventory_artifact and inspect_artifact but not
extract_artifact, so extracting any .app failed with execution_failure after
the output tree had already been written, and the output path was never
reported.

* refactor(binary): rename artifact bundle subject helper

isArtifactInventorySubject also covers extract_artifact for .app
bundles, so name it for the shared bundle-subject exemption.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/application/binary/BinarySessionExecution.ts

@@ -132,7 +132,7 @@ export const bindExecutionTarget = (
   if (
     result.value.subject !== null &&
     result.value.subject.sha256 !== target.sha256 &&
-    !isArtifactInventorySubject(operation, result.value.subject, target)
+    !isArtifactBundleSubject(operation, result.value.subject, target)
   )
     return err(
       new ProviderAdapterError(
@@ -143,10 +143,12 @@ export const bindExecutionTarget = (
   return ok({ ...result.value, subject: result.value.subject ?? subject });
 };
 
-const isArtifactInventorySubject = (
+const isArtifactBundleSubject = (
   operation: AnalysisOperation,
   subject: EvidenceSubjectTarget,
   target: BinaryTarget,
 ): boolean =>
-  (operation === "inventory_artifact" || operation === "inspect_artifact") &&
+  (operation === "inventory_artifact" ||
+    operation === "inspect_artifact" ||
+    operation === "extract_artifact") &&
   subject.path === (target.sourcePath ?? target.path);