Restrict invariant-suite publication to validated generated sources #214

Summary

The generated workflow's rememberInvariantSuitePublications walks every file under each task artifact root's invariant-suite/ directory and publishes it, while invariant-suite materialization validates only paths derived from implemented-properties.json, changed test-tree files, and dependency handoffs. An agent can add arbitrary extra files under invariant-suite/; those files are then copied/published without a corresponding validated provenance record.

Expected behavior

Publish only invariant-suite files selected from validated implementation/test provenance or trusted dependency suites, and reject unreferenced extras (or record them explicitly as a typed artifact). Preserve path/symlink/size checks for every published source.

Impact

Artifact reports can claim a complete invariant suite while carrying unreviewed files that were never tied to a property or source change, weakening provenance and making downstream Recon inputs non-deterministic.