feat(shared): add owner-bound resource references - #379

合同是对的；和 #386/#382 叠文件时要注意

占有 ≠ 权限、symlink/穿越/generation fail-closed、Workflow final-result 标 partial-owner-value、没有新的 child tool，这些都对。

两点：

1. publish 失败时 catch { return [] } 是对的（缺 refs 不是完成）。不要把「没有 refs」读成完整性。
2. 和 #386 抢 artifacts.ts / workflow.json。#386 用整份 manifest 字节判断 already-committed；这份若把 resourceRefs 写进同一文件，必须等 #386 改成 run id + 终态 + artifact digest，否则 leftover 收据会把更新后的 refs 盖掉。resolveOwnerFileResourceRef 有测试但还没接到消费路径，保持这样就好，不要先当通用读工具。

可以跟在 #386 收据身份修好之后合。

Exact-head review: 3949855

[P1] A resource reference can resolve successfully after its bytes have changed. extensions/shared/resource-reference.ts:161-171 computes revision from owner, path, byte length, and mtime only; resolveOwnerFileResourceRef() at lines 286-304 rechecks the same metadata. Replacing a file with different same-length bytes and restoring its original mtime therefore returns ok: true for a stale reference. I reproduced this with a four-byte file changed from aaaa to bbbb while preserving mtime.

The contract is meant to let consumers distinguish stale generation/revision and exact terminal evidence; filesystem timestamps are not an immutable byte identity. Please bind the reference to a content digest, or to an owner-provided immutable artifact revision whose write/publication lifecycle guarantees byte identity, and verify it on resolution. Add a same-size/same-mtime replacement regression.

Verification boundary: exact-head code review plus focused local reproduction; no production files were modified.

Reviewed exact head 6975a7c.

A compact owner-bound resource reference is potentially useful across Subagent, Workflow, and Background Terminal, but the current cross-capability contract still has one P1 safety gap:

• [P1] Symlink substitution is not fail-closed. inspectOwnedFile() checks path components with lstat, then resourceRevisionFile() separately reopens the pathname to hash it, and resolution ultimately returns a pathname that consumers reopen again. A component or file can be replaced between validation, digesting, and actual read. A no-follow opened handle with verified identity can bind the check and read; returning a re-openable path cannot establish that invariant.

P2 contract gaps remain: completeness exposes only complete/partial and cannot represent the requested unavailable/uncertain/expired states, and the required cross-capability handoff evidence comparing token cost/recovery success was not recorded.

Exact-head CI is green and the merge-tree is clean, but this changes model-visible result details across three owners and persists Workflow metadata. The P1 must be resolved before merging.