feat: import governed sandbox commits and enforce native CLI limits

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-09-runtime-transfer.json

@@ -0,0 +1,40 @@
+{
+  "schema": "hfact.runtime-transfer-verification.v1",
+  "date": "2026-09-09",
+  "rein_tests": 290,
+  "glas_tests": 133,
+  "actual_bwrap_owner_execution": true,
+  "task_authoring": "deterministic fixture",
+  "queue": "fixture client; heartbeat/close/replay exercised",
+  "artifact_tests": [
+    "exact commit retained after sandbox destruction",
+    "granted path acceptance",
+    "one commit ancestry",
+    "corrupt and truncated bundle",
+    "symlink refusal",
+    "expanded object limit",
+    "wrong head",
+    "missing capture",
+    "teardown failure",
+    "lease loss",
+    "source changed externally",
+    "ignored cache excluded"
+  ],
+  "native_controls": [
+    "profile USD and turn limits reach Claude CLI",
+    "version preflight",
+    "strict terminal cost/token/turn accounting",
+    "limit exhaustion refuses success"
+  ],
+  "provider_requests": 0,
+  "paid_factory_attempts": 0,
+  "profile_promoted": false,
+  "protected_runtime_rebuilt": false,
+  "remaining": [
+    "durable daily/total budget reservations and uncertain outcome recovery",
+    "provider cap semantics and conservative EUR treatment",
+    "matching protected runtime pins and exact factory identity/placement",
+    "G0 operating admission",
+    "real model G1 and natural Railiance queue G2"
+  ]
+}