Shorten run artifact paths for Windows reviewer workspaces

[rianjs]

Symptom

Windows reviewer workspaces can exceed MAX_PATH because runartifact.ForRun includes the full head SHA, full base SHA, and readable profile__postingIdentity in the artifact directory path.

Agreed layout

Use five path components below runs:

runs/<existing readable PR key>/<12-char head>/<12-char base>/<12-char scope hash>/run-<full UUID>

The PR key remains readable, SHA components use prref.ShortSHA, the scope component is statepaths.KeyHash(prKey, full head SHA, full base SHA, profile, postingIdentity), the full run UUID is retained, and agent IDs remain unchanged.

Acceptance

• Preserve existing ResumeScope validation, with directory scope represented by the 12-character tuple hash.
• Preserve five levels below runs so data-lifecycle pruning remains compatible.
• Existing runs remain resumable because resume uses the stored ledger artifact_path and runartifact.FromDir.
• A realistic SignalFT signal-adminapp-frontend reviewer repository path is below Windows MAX_PATH with the new layout.
• Blank profile or posting identity validation remains intact.

Compatibility

Do not migrate existing directories. Existing ledger artifact paths continue to resolve through runartifact.FromDir.

Non-goals

• Do not hash the PR key or agent ID.
• Do not shorten the UUID.
• Do not migrate existing directories.
• Do not alter Git configuration.
• Do not change statepaths.Layout.Run.
• Do not add speculative documentation or CI machinery.

[rianjs]

Shorten run artifact paths for Windows reviewer workspaces

Issue: #575
Branch: fix/575-shorten-windows-run-paths

Intent

Change only generated run artifact directories so Windows reviewer workspaces
stay below MAX_PATH while retaining readable PR identity, full run UUIDs, and
unchanged agent IDs.

Implementation

1. Add one focused internal/runartifact test that checks the compact layout:
   • readable PR key remains unchanged;
   • head and base use prref.ShortSHA (12 characters);
   • scope is statepaths.KeyHash over the full PR/SHA/profile/posting tuple and
     changes when profile or posting identity changes;
   • the full UUID remains in the run segment;
   • the path has five components below runs;
   • a realistic SignalFT signal-adminapp-frontend reviewer path is over 260
     characters with the legacy layout and under 260 with the new layout;
   • blank profile/posting identity validation is preserved.
2. Run the focused test before the production edit and record the red result.
3. Update only internal/runartifact/runartifact.go: preserve ResumeScope
   validation, replace the directory scope with statepaths.KeyHash, and use
   prref.ShortSHA for head/base path segments.
4. Run the focused test again and then the compatibility suites and repository
   check.

Compatibility and boundaries

• Keep exactly five levels below runs.
• Existing runs remain compatible because resume uses the stored ledger
  artifact_path and runartifact.FromDir.
• Do not migrate existing directories, hash the PR key or agent ID, shorten the
  UUID, alter Git configuration, change statepaths.Layout.Run, or add docs/CI
  machinery.

Verification

• go test ./internal/runartifact
• go test ./internal/pipeline ./internal/threadrespond ./internal/datalifecycle
• make check
• git diff --check

[rianjs]

Resolved by merged PR #576 (merge commit ab40daa).