feat(results): mirror run artifacts into canonical bundles

[christso]

Summary

• Adds a canonical run directory helper for .agentv/results/runs/<experiment>/<run_id>.
• Mirrors completed runs into the canonical run bundle when users write to legacy or explicit output paths, while preserving the requested output file/workspace.
• Keeps run-source metadata inside the canonical bundle and hardens run-source redaction for secret-shaped snapshots and grader definitions while preserving required_env placeholder names.
• Records av-wy0.1 Beads handoff/verification state.

Verification

• bun test apps/cli/test/commands/eval/artifact-writer.test.ts apps/cli/test/eval.integration.test.ts
• bun --filter agentv typecheck
• bun --filter agentv lint
• bun --filter @agentv/core build
• bun --filter agentv build
• git diff --check
• Push preflight: workspace typecheck + biome check .

Scope Notes

• Dashboard Files visibility is intentionally left to av-wy0.2.
• No Dashboard/docs/browser evidence was generated because this PR is CLI/results-only.
• No env or secret values are captured; redaction keeps only safe source metadata and required_env names.

[cloudflare-workers-and-pages]

Deploying agentv with    Cloudflare Pages

Latest commit:	54f746b
Status:	✅  Deploy successful!
Preview URL:	https://39d1099e.agentv.pages.dev
Branch Preview URL:	https://feature-av-wy0-1-run-artifac.agentv.pages.dev

View logs

[christso]

Closing as not planned. The run-bundle design has shifted away from the canonical run-source/manifest-style direction in this PR. The current Beads design is in av-wy0.3: materialize per-test task bundles under each result artifact directory using task/EVAL.yaml, task/targets.yaml, task/files/, and task/graders/, with input.md remaining the rendered agent input and reruns writing to a separate output run directory to avoid nested .agentv/results artifacts. No branch deletion requested.