feat(environment): export an environment manifest as an agent environment bundle (#4999)

Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task.

Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio.

Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document.

Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

src/application/RegularFileRead.ts

@@ -22,6 +22,8 @@ export interface RegularFileReadOptions {
   readonly signal?: AbortSignal | undefined;
   readonly symlinks?: "follow" | "reject";
   readonly resources?: ArtifactResourceScope;
+  /** Runs on the opened file's own state before any byte is read; throw to refuse the read. */
+  readonly admit?: (state: Stats) => void;
 }
 
 export class InvalidUtf8FileError extends TypeError {
@@ -223,6 +225,7 @@ const readRegularFileContent = <Value>(
   withRegularFile(
     path,
     async (handle, stats) => {
+      options.admit?.(stats);
       const bytes = await readBoundedFileBytes(
         handle,
         stats.size,