fix(redaction): idempotent anchor refresh and retirement digest cross-check

[solomonneas]

Summary

• Make _refresh_chained_anchors a no-op when the recomputed journal bytes already match, so a second cleanup/verify pass performs zero journal or projection writes.
• Restore the split-retirement digest cross-check: when a parent carries rewritten_digest_retired_by, the retiring child's parent_record_sha256 must equal the parent's current record digest.
• Realign the child during parent retirement (before the parent state write) and again if a retired parent record is rewritten during its own cleanup.

Acceptance criteria → tests

Acceptance	Test
Second verify pass performs zero writes when anchors already match	tests/test_run_redaction.py::test_second_cleanup_verify_pass_performs_zero_anchor_refresh_writes
Tampered split-retirement record fails with a bounded error	tests/test_run_redaction.py::test_tampered_split_retirement_record_fails_digest_cross_check
Existing redaction tests unchanged/green, including overlapping-anchor preservation	tests/test_run_redaction.py (full file), including test_redaction_preserves_first_anchor_when_second_range_contains_it

Constraints honored

• No changes to event canonicalization, the run.redaction.recorded allowlist, or projector output.

Verification

• brigade work verify run --target . --command "./scripts/verify" --capture brigade-work
• Receipt: 20260801-034219-work-verify-9fb280

Notes

• External grader review before merge; do not merge from this PR.

Closes #638.

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7137dc84-81bc-42d9-9aaa-5298df7fec4f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}