fix(agentic-engineering): pin required runtime asset bytes

[devantler]

🤖 Generated by the Agentic Engineer

Problem

The provider-neutral desired state declares required runtime assets by path only. A consumer can prove that the classifier exists and is executable while serving different bytes than the reviewed plugin revision.

Acceptance criteria

• Required runtime assets carry a lowercase SHA-256 digest with their plugin-relative path.
• Manifest validation proves each declared digest matches a contained regular executable file.
• Agent-only onboarding retains the asset and digest without a divergent copy.
• Hermetic tests reject a stale runtime-asset digest.

Discovered during exact-head review of devantler-tech/monorepo#2436.

[coderabbitai]

🔗 Related PRs

#87 - fix(agentic-engineering): retire human promotion gate [merged]
#120 - security(agentic-engineering): make the surveyor's read-only boundary executable [merged]
#130 - feat(agentic-engineering): measure Improver effectiveness [merged]
#132 - feat(agent-improver): research on evidence-clean runs [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!