fix: verify staged mount file writes

[chubes4]

Summary

• hash-verify each successful direct staged-input write inside the persistent Playground PHP runtime
• repair missing or mismatched files from the captured payload, and fail materialization if byte-for-byte preservation cannot be established
• exercise an optimized, classmap-authoritative Composer vendor mount through a real wordpress.phpunit run and assert test discovery

Root cause

The direct Playground writer was treated as successful when it returned without throwing. That did not establish that the target VFS contained the same bytes, so a large staged tree could complete with a silently omitted or mismatched generated file. For Composer vendors, composer/autoload_real.php could then reference a ComposerStaticInit... class whose matching composer/autoload_static.php was absent or stale, failing before PHPUnit discovery.

Invariant

After each bounded direct-write batch, every target file must hash-match the exact captured host payload before staged-input materialization completes. Missing or mismatched files are rewritten through the persistent PHP runtime and hash-checked again. Any file that still cannot be preserved fails materialization instead of exposing a partial mount.

This stays generic to mount materialization: there are no Homeboy, Roadie, or Composer-specific runtime branches.

Tests and evidence

• npm run build
• npx tsx tests/mount-materialization.test.ts
• npx tsx tests/staged-input-materialization.test.ts
• npm run test:playground-phpunit-readonly-cache-integration
  • Composer fixture uses optimized/classmap-authoritative static autoloading
  • generated autoload_real.php and autoload_static.php class identities are checked
  • real wordpress.phpunit diagnostics report DISCOVERY ... found=1 and enter run_tests
• npm run smoke -- --group=policy passed
• npm run smoke -- --group=package passed; disposable MySQL E2E skipped because Docker is unavailable
• npm run check reached the existing main-branch command-registry-smoke failure tracked by command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745; this branch has no diff in that contract

The reported downstream Homeboy reproduction was also attempted, but the deployed probe stopped earlier on a stale Playground archive cache lock before wordpress.phpunit could start. The in-repo real Playground probe above covers the corrected owner-layer path.

Fixes #1949