Fix scoped repaired promotion source root

[SoundBlaster]

Summary

• Resolve workspace-scoped repaired candidate paths from the repository root before Git Service copies approved files.
• Add integration and resolver regression coverage for runs/<workspace>/repaired_materialized_candidate_specs.

Motivation

A real hosted-operation-canary promotion review reached worktree preparation but could not find approved repaired files because the wrapper used the workspace runs directory as the source root.

Goals

• Support durable workspace-scoped repaired promotion paths without changing approved paths or staging scope.
• Preserve fail-closed path validation in Git Service.

Changes

• Generalize repaired materialized path recognition for runs/<workspace>/....
• Derive the copy source root from the enclosing runs directory.

Validation

• Tests added/updated for changed behavior
• Local checks passed

Commands run:

.venv/bin/python -m unittest tests.test_platform_cli.PlatformCliTests.test_product_candidate_promotion_execute_copies_repaired_paths tests.test_platform_cli.PlatformCliTests.test_product_candidate_promotion_execute_copies_workspace_scoped_repaired_paths tests.test_platform_cli.PlatformCliTests.test_product_candidate_promotion_resolves_scoped_repaired_paths_from_repository_root tests.test_platform_cli.PlatformCliTests.test_product_candidate_promotion_execute_defaults_repaired_source_dir -v
.venv/bin/python -m py_compile scripts/platform.py
make python-quality
git diff --check

Results:

• Targeted tests: 4 passed.
• Platform quality suite: passed.

Risks / Notes

• Backward compatibility impact: existing unscoped repaired paths retain the same source-root resolution.
• Migration/config changes required: none.
• Known limitations: this PR does not retry the prior failed operation; it makes a new controlled execution safe after merge.

Checklist

• PR title clearly describes the change
• Scope is focused and minimal
• Documentation updated (or N/A)
• Workflow/artifact changes distinguish artifact presence from readiness/status
• Temporary or intermediate paths are scoped to the current run/task where relevant
• No secrets or sensitive data added

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e827b5a26a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject repaired paths outside current run scope

When executing a scoped run such as plan.runs_dir = /repo/runs/current, a stale approval path like runs/other/repaired_materialized_candidate_specs/foo.yaml now passes product_candidate_promotion_is_repaired_materialized_path and this returns /repo as the copy root, so Git Service will copy /repo/runs/other/... into the review worktree. The existing source-ref checks constrain approval source artifacts to plan_runs_dir, but they do not constrain promotion_request.paths, so this can promote another run/workspace's repaired file instead of failing closed.

Useful? React with 👍 / 👎.