refactor(agent-candidate): give captured-artifact evidence one schema owner

[drewstone]

Plan

Problem - agent-candidate-execution-plan-schema.ts and agent-candidate-outcome-schema.ts each built the same evidence schema by hand: same object shape, same .strict(), and the same two integrity refusals - the captured artifact's hash must equal the digest its material canonicalizes to, and the artifact must carry bytes. The outcome copy already took a label; the plan copy hardcoded "plan" into both messages, so planEvidenceSchema(kind, material) was exactly evidenceSchema(kind, material, "plan").

Change - one agentCandidateEvidenceSchema in a new internal module; both call it.

Why long-term right - this is a digest-identity rule. Evidence whose artifact hash names something other than its material is evidence for a different value, and nothing cross-checks two hand-written copies of that check - the satisfies z.ZodType<T> annotations cover the shape, not the superRefine bodies. One owner is the only thing that keeps 11 evidence schemas refusing on the same grounds.

Cost - 4 files, all inside agent-interface. No public API change: the owner lives in a module the package index does not re-export, so dist/index.d.ts is byte-identical to origin/main. Rollback is a revert.

Proof

Every evidence schema behaves identically - measured, not asserted. Built origin/main and this branch, enumerated every exported *EvidenceSchema, and ran each against four inputs (empty, artifact-hash mismatch, zero-length artifact, an extra field a strict object must reject), capturing every issue path and message:

11 schemas x 4 inputs = 44 outcomes: identical

The only line that differed on my first attempt was the schema count - 12 against 11 - because the owner had landed in a module that is re-exported transitively through agent-candidate-schema.js and had silently become public API. Nothing outside the package needs it, so I moved it to an internal module and re-ran: 11 against 11, and dist/index.d.ts byte-identical.

gate	result
pnpm build	9/9 packages Done
pnpm check-types	9/9 packages Done
pnpm test	91 files, 1544 passed, 0 failed - unchanged from origin/main
pnpm check:package-artifacts	9 packages, 31 exports, 62 export targets
pnpm check:control-artifacts	3 packed contracts passed; 7 files / 145 tests

Simplification

Simplification: the captured-artifact evidence schema, including both integrity refusals, was 2 hand-written copies and is now 1 owner; the plan module's wrapper is 3 lines that name its label.
Net: +57 / -58 lines, 4 files, 2 copies of one digest-identity rule collapsed to 1 owner.
Not done here: agent-candidate-code-schema.ts and agent-candidate-lineage-schema.ts also import agentCandidateCapturedArtifactSchema and check artifact integrity, but they check different things about it - they are not third and fourth copies of this rule, and folding them in would extract shape rather than intent.
Tests: +0, -0. The claim is "these 11 schemas accept and refuse exactly what they did before", and the 44-outcome before/after comparison above proves that better than a unit test could; the existing schema tests in agent-candidate-execution-plan-schema.test.ts and agent-candidate-outcome-schema.test.ts already exercise both refusals and pass unchanged.

[tangletools]

✅ Auto-approved drewstone PR — 19aa5341

This PR was opened by the trusted drewstone account.

This approval is provisional and was applied by the local stand-in because the pr-reviewer webhook host is unreachable (2026-08-21). CI on this head is fully green. The full PR reviewer audit re-runs via the resweep when the service returns and will publish findings if it detects issues.