Workroom v0.1: expose runtime sandbox receipts as stable evidence refs

[mdheller]

Parent: SocioProphet/prophet-platform#519

Scope

Expose AgentPlane runtime sandbox run records to the DevSecOps Intelligence Workroom as stable evidence references.

Existing relevant artifacts:

• schemas/sandbox/runtime-sandbox-run.v0.1.schema.json
• tools/validate_runtime_sandbox_run.py
• sandbox runtime fixtures under tests/fixtures/sandbox/

Constraints

• AgentPlane owns execution records, sandbox run records, replay records, evidence artifacts, receipts, and validation artifacts.
• Prophet Platform may orchestrate and display the workroom, but must not duplicate AgentPlane runtime evidence.
• Do not certify Signadot parity unless the runtime parity gates have observed evidence.

Acceptance criteria

• Runtime sandbox runs expose stable evidence:// and receipt:// refs for workroom consumption.
• Runtime parity level remains explicit: contract_only or runtime_observed in the existing schema, with any future intermediate level added deliberately and compatibly.
• Requested, allocated, failed, and teardown states remain semantically validated.
• Missing evidence or missing leak-check still fails validation.