* fix(cli): seal in-process Evidence before publishing
The CLI rebuilt a plain bundle from records it had already authenticated,
so writeEvidenceBundle cloned and authenticated the complete analyzed
graph again at the final checkpoint. On a default heap that second copy
could exceed available memory after minutes of analysis and discard the
whole run.
Seal the in-process bundle once so publication can stream the canonical
form without the redundant authentication copies. The regression test
fails on the previous behavior with resource_constraint under a one-byte
heap allowance.
Fixes#8411
* fix(cli): preserve the heap check for mutable Evidence
Only seal the publication bundle when every record is already immutable.
Mutable producer records keep the writer's existing heap check instead of
being copied before that check. The regression now covers the safe
fallback and lets the shared temporary-directory fixture own cleanup.
* test(cli): keep a distinct mutable source in the publication regression
Seal the main record and give the mutable source its own evidence ID so
the map cannot replace it before the bundle guard runs.
2SinceJuly
1dd70f6c2b