fix(plugin): keep model-authored runtime status out of finalized reports

[cstolting-collab]

Fixes #687.

Summary

Rebases the report-integrity fix from #703 onto current main.

The original implementation is by @russlan23. This branch preserves the minimal three-file solution: finalized Markdown reports no longer render model-authored scan.scope.runtimeStatus, while manifest and draft-schema compatibility are unchanged.

Changes

• Stop projecting free-form runtimeStatus into generated Markdown reports.
• Keep the field intact in canonical manifest data and draft schemas.
• Add a finalization regression proving stale pre-finalization narration cannot appear in a completed, sealed report.
• Update the completed-scan report fixture.

Validation

• Targeted finalization/projection tests: 2 passed.
• pnpm --dir sdk/typescript run build:ci: passed.
• Plugin source compatibility check: passed.
• Plugin source compatibility tests: 9 passed.
• git diff --check: passed.

The full finalization test file ran 156 passed, 2 skipped, and 55 subtests passed, with one unrelated failure under the available Python 3.10: its datetime.fromisoformat does not accept a trailing Z. The repository requires Python 3.12. Ruff was not run because the available Ruff version cannot parse the repository's pinned RUF105 configuration.

Attribution

This branch rebases #703 and retains its implementation and regression coverage. A local CML evaluation used ContinuityRegistry and ContinuityProjection to lock repository, revision, scope, plan, and candidate identity while recording evidence. CML did not generate the implementation or assess Python semantics; no CML runtime code is included.

Risk and rollout

Low risk: deterministic Markdown presentation changes only. Finalizer-owned lifecycle fields, manifests, schemas, artifact digests, CLI behavior, and compatible consumers of runtimeStatus are unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commit, changed files, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

The original fix has now merged in #703. Closing this duplicate; thank you for refreshing and validating the change.