fix(#4132): verify durable runtime surface sources (#4182)

* fix(#4132): verify durable runtime surface sources

* chore(#4132): record PR number in changeset

* test(#4132): cover rejected commands source alias

* fix(#4132): reject aliased package fallback

* test(#4132): cover rejected agents source alias

* test(#4132): cover partially aliased marker provider

* fix(#4132): reject partially aliased source providers

* test(#4132): cover routed source identity probes

* fix(#4132): route installed source identity probes

* refactor(#4132): tighten installer source metadata

* test(#4132): cover corpus trust boundary attacks

* fix(#4132): close installed corpus trust gaps

* refactor(#4132): keep installer authority private

* fix(#4132): preserve private installer fallback

* test(#4132): preserve fixture source authority

* fix(#4132): reject overlapping source fallback

* fix(#4132): avoid redundant installed corpus reads

* refactor(#4132): simplify provider resolution

* test(#4132): sync install tree fixtures after rebase

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>

tests/agent-tools.install.test.cjs

@@ -253,7 +253,8 @@ test('Kimi neutralizes ~/.claude/gsd-core references instead of leaking a repoin
   // to see the ORIGINAL `~/.claude/gsd-core` text; kimi/kimi-code capability.json
   // now opt out via hostBehaviors.noPathRewrite so that still holds.
   const install = installRuntime(t, 'kimi', { scope: 'global' });
-  const artifacts = emittedAgentArtifacts(install, 'gsd-executor');
+  // Inspect generated prompts, not the installation-owned raw source corpus.
+  const artifacts = emittedAgentArtifacts(install, 'gsd-executor', path.join(install.configDir, 'agents'));
   assert.ok(artifacts.some((artifact) => artifact.includes('GSD core')),
     'a ~/.claude/gsd-core reference must neutralize to prose, not a repointed Kimi path');
   assert.ok(artifacts.every((artifact) =>