[chubes4]

Summary

• Propagate validated caller provider/model into the native runtime package and canonical agents/chat input.
• Keep runtime-source preparation private, upload compact provenance only, and reject prepared plugin source leakage.
• Cover provider policy, exact artifact layout, and runtime-package provider forwarding.

Fixes #1769
Failed run: https://github.com/Automattic/build-with-wordpress/actions/runs/29302824064

How to test

1. Run npm run build.
2. Run npm run test:runtime-sources-materialization.
3. Run npm run test:php-runtime-package-public-contract.
4. Run npm run test:agent-task-contracts.
5. Run npm run test:redaction.
6. Run npm run test:source-root-preparation.
7. Run WP_CODEBOX_RUN_NETWORK_INTEGRATION=1 npm run test:runtime-sources-playground-integration.
8. Run npm run test:production-boundary-enforcement.
9. Run actionlint .github/workflows/run-agent-task.yml.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI gpt-5.6-terra via OpenCode
• Used for: Traced the native agent-task runtime, implemented the provider and source-isolation changes, and added deterministic tests.