test: strengthen and prune audited test coverage (#8573)

* test: strengthen and prune audited test coverage

* test: require delivered DeepSeek skill instructions

* test: keep schema fixture types private

* test: verify Gemini receives skill instructions

* test: bind Qwen skill evidence to its tool result

* test: report NativeAOT verifier checks precisely

* fix: verify Ghidra cleanup paths reliably

* fix: verify Command Code skill activation

* test: tighten cleanup and fixture checks

* test: verify packet capture evidence is recorded

* fix: report HTTP3 capture provenance accurately

* test: preserve resource coverage through MCP

* test: prune repeated assertions and retain cancellation identity

* fix: validate client verifier fixture paths

* test: skip Copilot verifier cases on Windows

* test: keep verifier setup target relative

scripts/verify/javascript/runtime-observation.mjs

@@ -1,8 +1,17 @@
 #!/usr/bin/env node
 
-import { readFile, realpath } from "node:fs/promises";
+import { realpath } from "node:fs/promises";
 import { parseArgs } from "node:util";
 
+import { readStableArtifact } from "../../../dist/artifacts/readStableArtifact.js";
+import { ArtifactReaderFailure } from "../../../dist/artifacts/ArtifactReader.js";
+import { ArtifactResourceScope } from "../../../dist/artifacts/ArtifactResourceScope.js";
+import {
+  ArtifactFileCleanupFailure,
+  artifactFileCompletion,
+  artifactFilePrimaryFacts,
+} from "../../../dist/artifacts/ArtifactFileOperation.js";
+
 import { reconcileJavaScriptRuntimeEvidence } from "../../../dist/application/javascript/JavaScriptRuntimeReconciliationService.js";
 import { analyzeJavaScriptApplicationWithOwnedScope } from "../../lib/javascript-application-analysis.mjs";
 import {
@@ -52,9 +61,11 @@ for (const encoded of options.mapping) {
   const mapping = parseMapping(encoded, staticLayers.length);
   staticLayers[mapping.layer].runtime_mappings.push(mapping.value);
 }
-const runtimeObservations = (
-  await Promise.all(options["runtime-evidence"].map(readEvidenceFile))
-).flat();
+const runtimeObservations = [];
+for (const path of options["runtime-evidence"]) {
+  const observations = await readEvidenceFile(path);
+  for (const observation of observations) runtimeObservations.push(observation);
+}
 const reconciled = reconcileJavaScriptRuntimeEvidence({
   static_layers: staticLayers,
   runtime_observations: runtimeObservations,
@@ -95,10 +106,47 @@ process.stdout.write(
 );
 
 async function readEvidenceFile(path) {
-  const bytes = await readFile(await realpath(path));
-  if (bytes.byteLength > 64 * 1024 * 1024)
-    throw new Error(`Runtime Evidence exceeds 64 MiB: ${path}`);
-  const value = JSON.parse(bytes.toString("utf8"));
+  const scope = new ArtifactResourceScope();
+  let outcome;
+  try {
+    outcome = {
+      ok: true,
+      value: await readStableArtifact(
+        await realpath(path),
+        64 * 1024 * 1024,
+        undefined,
+        undefined,
+        scope,
+      ),
+    };
+  } catch (cause) {
+    outcome = { ok: false, cause };
+  }
+  try {
+    await scope.close();
+  } catch (cleanupCause) {
+    if (!outcome.ok)
+      throw new AggregateError(
+        [outcome.cause, cleanupCause],
+        "Verifier cleanup failed",
+        { cause: outcome.cause },
+      );
+    throw cleanupCause;
+  }
+  if (!outcome.ok && outcome.cause instanceof ArtifactFileCleanupFailure) {
+    const completion = artifactFileCompletion(outcome.cause);
+    outcome =
+      completion === undefined
+        ? { ok: false, cause: artifactFilePrimaryFacts(outcome.cause).cause }
+        : { ok: true, value: completion.value };
+  }
+  if (!outcome.ok) {
+    const cause = outcome.cause;
+    if (cause instanceof ArtifactReaderFailure && cause.reason === "limit")
+      throw new Error(`Runtime Evidence exceeds 64 MiB: ${path}`, { cause });
+    throw cause;
+  }
+  const value = JSON.parse(outcome.value.bytes.toString("utf8"));
   return Array.isArray(value) ? value : [value];
 }