report bundle mutates verified final-report artifacts without refreshing their verification marker #529

Problem

Running the CLI report bundle command calls reconcileReportArtifacts() before collecting files. For a completed, Smithers-verified run this can rewrite artifacts/final-report/report.md and report.json, but it only refreshes artifact-manifest.json; .ultrafuzz-verification/final-report.json remains pinned to the pre-reconciliation bytes.

That leaves the source run internally inconsistent as a side effect of a packaging command: the live and bundled report bytes no longer match the run's verification attestation.

Reproduction

node packages/cli/dist/index.js report bundle \
  aave-v4-v056-gpt55-xhigh-invariant-only-20260811-full-timeout \
  --project /home/ubuntu/aave-v4-ultrafuzz-v0.5.6 \
  --json

The command succeeded, but the hashes changed from:

report.md   12a93eeadb179854d0052c34a84f441a9aba7db6e0ee091e5f75820d133ca989
report.json 3a0143216bdc1ec290ebe529fe0e8beab04d6e0909d54df9d758f2bd81085695

to:

report.md   7c5cdb067a62c1cb324cb4db9c2df635d6b5fc596c60cbb874dda0fc6eff3df1
report.json 61fd7ff7c2dbe65106910ef2ab2790a148979f135236ff162ce99c1e9e477ec0

while .ultrafuzz-verification/final-report.json still records the first pair in both artifacts and publications.

Relevant code

• packages/cli/src/commands/report/bundle.ts calls reconcileReportArtifacts(layout.root).
• packages/cli/src/report-artifacts.ts rewrites report JSON/Markdown and the artifact manifest.
• Runtime already has refreshVerifiedArtifactDigest() for sanctioned post-verification rewrites.

Expected

A report-bundle operation should either:

1. be read-only and package already-verified report bytes; or
2. perform a clearly sanctioned reconciliation and atomically refresh/re-verify all affected attestations, with diagnostics.

It must not silently invalidate the source run's verification marker.