fix: keep artifact checksums in sync

[matthewflint]

Summary

This PR is intentionally stacked on top of #2972.

On top of the safe LocalFile open path from that PR, this change:

• computes artifact checksums from the same bytes written into the sandbox
• preserves local source-read errors when write backends wrap stream failures
• adds focused LocalFile / LocalDir regressions for checksum drift and wrapped read failures

Testing

• uv run pytest -q tests/sandbox/test_entries.py
• uv run ruff check src/agents/sandbox/entries/artifacts.py tests/sandbox/test_entries.py

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 344bb4728a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23168abe77

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[matthewflint]

Restacked this on top of #2972 and force-pushed a clean history. The PR base is still main, so it includes the #2972 changes for now; intended merge order is #2972 first, then this.

[matthewflint]

Restacked this on the updated #2972 head and force-pushed. It now inherits the Windows metadata assertion fix; intended merge order is still #2972 first, then this PR.