feat(environment): export an environment manifest as an agent environment bundle (#4999)

Export an authenticated capture and environment manifest as a pinned agentenv bundle with provenance, a replay verifier and smoke task.

Followups preserve immutable input ownership, bounded discovery, caller paths and numeric values; bind bundle writes and package copying to retained filesystem owners; verify POSIX modes; retain cleanup authority; and verify framework/npm executable selection. Default MCP remains stdio.

Validation: pinned Linux toolchain, typecheck/build/lint/format/docs/knip, 452 focused tests, ten product-catalog cases, real GitHub response replay in the generated non-root Docker image, and the real pinned agentenv framework smoke workflow. Platform and resource-measurement limits are recorded in the feature verification document.

Co-authored-by: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

src/artifacts/SafeOutputTreeCleanup.ts

@@ -16,6 +16,7 @@ export const removeOwnedTree = async (input: {
   readonly rootIdentity: DirectoryIdentity;
   readonly directories: Map<string, DirectoryIdentity>;
   readonly files: Map<string, FileIdentity>;
+  readonly preserveRoot?: boolean;
 }): Promise<void> => {
   const { outputRoot, rootIdentity, directories, files } = input;
   const filesByDirectory = new Map<string, [string, FileIdentity][]>();
@@ -50,7 +51,7 @@ export const removeOwnedTree = async (input: {
   );
   await assertPathIdentity(outputRoot, rootIdentity);
   await requireEmpty(outputRoot);
-  await rmdir(outputRoot);
+  if (!input.preserveRoot) await rmdir(outputRoot);
 };
 
 const removeFiles = async (