#27402 feat(cloud): add read-only fork-candidate provenance and comparison receipts

Summary

Add a read-only, provider-neutral evidence contract for future parallel VM-fork candidates. This is the first bounded slice of HQ #5072 and #4864; Chief RunSpec ownership remains with #2358.

• ForkSourceEvidence records requested+observed full Git SHA, optional captured dirty-tree digest, image/setup/checkpoint/input/context digests and context coverage.
• forkExperimentBranch(runId, variantId, attemptNumber) generates deterministic Git-safe cmux/exp/<run>/<variant>-a<N> refs.
• compareForkCandidateReceipts refuses to call different start states/test suites comparable; reports missing test/review/artifact/identity evidence; requires independent reviewer identity; reports missing cost as unknown instead of zero.
• Pure functions only: no VM allocation, credentials, backend routes, fork activation, winner promotion or change to existing Cloud behavior. Producer-side verification and persisted RunSpec receipts are follow-up work.

Testing

• tsc --noEmit --target ES2022 --module nodenext --moduleResolution nodenext --strict --skipLibCheck web/services/vms/forkCandidateReceipts.ts — passed against the standalone module.
• The eight bun:test cases were run against Node 22's built-in test runner using a temporary assertion shim (8/8 passed). The repository's Bun suite/CI has not run locally because Bun is unavailable here; PR checks should run the authoritative tests.

Review notes

• This is intentionally a contract, not a security guarantee; workers must attest the fields from the actual guest and avoid accepting candidate-provided receipts as trusted facts.
• Compare permits missing cost as an explicitly flagged limitation; promotion policy must require the appropriate cost evidence if hard all-in spend admission is claimed.
• Please review whether the existing RunSpec schema already has canonical field names to reuse before integrating producers.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a provider-neutral evidence contract for future parallel VM-fork comparisons. This first slice is pure and read-only: it never allocates VMs, reads credentials, or changes existing Cloud behavior.

• ForkSourceEvidence captures requested and observed Git SHAs, optional dirty-worktree digest, image/setup/input/context digests, and context coverage.
• forkExperimentBranch generates deterministic Git-safe refs like cmux/exp/<run>/<variant>-a<N>.
• compareForkCandidateReceipts flags missing or duplicated identities, unverified inputs, incomplete context, skipped tests, non-independent reviews, and unknown costs. Costs are never treated as zero.

Tests cover the comparison logic and branch-name validation.

Summary by CodeRabbit

• New Features
  • Added comparison of VM fork candidate results, including checks for matching starting inputs and test suites, evidence completeness, and independent reviews.
  • Comparisons now report whether cost data is complete, partial, or unknown, and identify when candidate results are not comparable.
  • Added consistent experiment branch naming with validation for run, variant, and attempt values.