test(harness): probe live discovery in isolated sandboxes

[solomonneas]

Summary

• Add --run-deep-probes as an explicit opt-in while preserving the default declared_only_not_executed policy.
• Extend deep-probe fixtures with optional inline {command, args} discovery specs and emit one receipt per declared probe.
• Run specified probes in throwaway HOME/XDG sandboxes with exact command and argument gates, bounded output, path scrubbing, and credential redaction.
• Keep spec-less, blocked, external-only, and invalid fixtures declared-only without process launch.

Verification

• brigade work verify run --target . --command "pytest -q tests/test_harness_conformance_probe.py" --capture brigade-work
  • Receipt 20260723-152256-work-verify-1d1010
  • 54 passed in 0.41s
• brigade work verify run --target . --command "./scripts/verify" --capture brigade-work
  • Receipt 20260723-152316-work-verify-7abfb7
  • 4014 passed, 3 skipped in 379.31s
  • Coverage: 82.53%

Closes #345.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f64a1cc-ca08-487c-af1d-389da49597e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-345-live-discovery

---

_{Comment @coderabbitai help to get the list of available commands.}