fix(desktop): preserve capture evidence and output ownership (#9899)

* fix(desktop): retain capture identity and cleanup ownership

* fix(desktop): validate destinations and finish inputs before export

* fix(desktop): preserve package ownership and apt trust boundaries

* fix(sqlite): preserve observed facts and distinguish special real values

* fix(desktop): bind computer files to data-object metadata

* test(desktop): count the tagged negative-zero cell spelling

SQLite view cells encode negative zero as a real object so it stays
distinct from the text "-0". The byte budget follows that spelling.

* fix(desktop): keep unresolved discovered state directories

Canonicalizing an unreadable path or dangling symlink aborted capture
before the inventory could record that the path was unknown. Those
discovered directories now keep their absolute spelling in the scope.

* test(desktop): keep the capture scope suite within its line limit

The unresolved state-directory case lives beside the suite so the
existing callback stays within the lint limit.

* fix(desktop): retain cancellation through capture input cleanup

* fix(desktop): avoid reserved Pydantic settings properties

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

src/application/sqlite/SqliteDatabaseService.ts

@@ -3,11 +3,10 @@ import type { ExecutionOptions } from "../AnalysisProvider.js";
 import type { SqliteDatabasePort } from "./SqliteDatabasePort.js";
 import type { AnalysisError } from "../../domain/analysisErrorBase.js";
 import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
-import {
-  createEvidence,
-  type Evidence,
-  type EvidenceSubjectTarget,
-} from "../../domain/evidence.js";
+import type { Evidence, EvidenceSubjectTarget } from "../../domain/evidence.js";
+import { createAnalysisExecutionEvidence } from "../../domain/analysisObservation.js";
+import { ownedJsonValueSchema } from "../../domain/jsonValue.js";
+import { completeProviderEvidence } from "../ProviderOperationExecution.js";
 import {
   inspectSqliteDatabaseInputSchema,
   sqliteDatabaseSchema,
@@ -19,7 +18,7 @@ import {
   sqliteSchemaScope,
   sqliteInspectionParameters,
 } from "../../domain/sqlite/sqliteDatabase.js";
-import { err, ok, type Result } from "../../domain/result.js";
+import { err, type Result } from "../../domain/result.js";
 
 const OPERATION = "inspect_sqlite_database";
 
@@ -102,18 +101,14 @@ export class SqliteDatabaseService {
           "SQLite adapter returned malformed data or changed the selected database identity/table/row limit/worker budget.",
         ),
       );
-    return ok(
-      createEvidence(execution.subject, execution.provider, {
-        operation: OPERATION,
-        parameters: sqliteInspectionParameters(input.value),
-        result: report.data,
-        ...(execution.rawResult === null
-          ? {}
-          : { rawResult: execution.rawResult }),
-        confidence: "observed",
-        locations: execution.locations,
-        limitations: execution.limitations,
-      }),
+    return completeProviderEvidence(
+      createAnalysisExecutionEvidence(
+        OPERATION,
+        sqliteInspectionParameters(input.value),
+        { ...execution, result: ownedJsonValueSchema.parse(report.data) },
+        "observed",
+      ),
+      options?.signal,
     );
   }
 }