fix(evals): keep report dependency proof with lockfile refresh (#18063)

<!-- entire-trail-link-start -->
https://entire.com/gh/paperclipai/-/trails/192/changes/paperclip/192
<!-- entire-trail-link-end -->

## Thinking Path

> - Paperclip manages AI agents and runs paid Product E2E evaluations.
> - Paid work needs a report that can install its trusted dependencies.
> - The report uses a reviewed offline lock correction.
> - New UI dependencies can make that correction stale while its lock
hash still matches.
> - The lockfile bot must refresh the correction with its lock changes.
> - This PR also checks manifest consistency offline before model
admission.

## Linked Issues or Issue Description

**What happened?**

Current master declares new CodeMirror and YAML UI dependencies. Its
committed lock omits those UI importer entries. The existing report
correction accepts that lock, but a frozen install then fails with
`ERR_PNPM_OUTDATED_LOCKFILE`. This can waste completed paid work before
the report fails.

Refs #18059. That bot PR supplies the matching lock. This PR keeps the
root lock bot-owned and supplies its exact offline report correction.
The correction changes 21 importer lines and leaves all package records
unchanged.

**Expected behavior**

The existing bot includes matching report proof in its dependency PR.
Paid authorization rejects stale manifests before model work. Report
installation still accepts only reviewed hashes and applies no registry
resolution.

**Steps to reproduce**

1. Run a frozen pnpm 9.15.4 install on master at
`7f10cc058568e3c1ac133cf24f3b4000cbdfca0e`.
2. Observe the missing UI importer entries.
3. Apply the reviewed correction in this PR. The frozen install passes.

## What Changed

- Add an explicit refresh mode that derives the offline patch and hashes
from a known committed lock and the bot's resolved lock.
- Keep the existing unknown-lock, patch hash and output hash guards.
- Include the proof files in the existing lockfile bot PR. New bot PRs
use complete descriptions; existing descriptions stay intact.
- Validate the frozen lock against current manifests offline before paid
admission, using the existing pinned pnpm version.
- Refresh the current correction and document this process. The root
lockfile is not committed here.

## Verification

- 24 focused report-lock and workflow-security tests pass. They cover
offline replay, tampered input/patch/output rejection, real Git refresh,
unknown-base refusal and unchanged proof.
- A full frozen install passes after the reviewed correction, with
lifecycle scripts disabled.
- A fresh source archive validates offline with an empty package store.
- A deliberate manifest change fails that same offline check with
`ERR_PNPM_OUTDATED_LOCKFILE`.
- Both workflow files parse as YAML. All 95 shell steps pass Bash syntax
checks.
- `git diff --check` passes. These checks make no model requests.
- Full repository checks and fresh reviews must pass on the final PR
head before merge.

## Risks

- Dependency changes must still pass review. Refresh refuses an unknown
committed baseline.
- The bot now commits two additional proof files. Its write permissions
and target branch stay unchanged. Existing PR descriptions are
preserved.
- The paid authorization job adds an offline manifest check. It runs no
package lifecycle scripts.
- No budget, provider credential, environment permission, schedule or
paid enable gate changes.

## Model Used

- OpenAI Codex, GPT-6, with reasoning and code execution tools. The
exact serving variant and context window are not exposed in this
session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/refresh-lockfile.yml

@@ -39,6 +39,9 @@ jobs:
       - name: Refresh pnpm lockfile
         run: pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
 
+      - name: Refresh reviewed eval report dependency proof
+        run: node tests/runner-e2e/prepare-report-lock.mjs --refresh
+
       - name: Fail on unexpected file changes
         run: |
           changed="$(git status --porcelain)"
@@ -46,7 +49,8 @@ jobs:
             echo "Lockfile is already up to date."
             exit 0
           fi
-          if printf '%s\n' "$changed" | grep -Fvq ' pnpm-lock.yaml'; then
+          unexpected="$(printf '%s\n' "$changed" | awk '$2 != "pnpm-lock.yaml" && $2 != "tests/runner-e2e/report-lock.json" && $2 != "tests/runner-e2e/report-lock.patch" { print }')"
+          if [ -n "$unexpected" ]; then
             echo "Unexpected files changed during lockfile refresh:"
             echo "$changed"
             exit 1
@@ -69,7 +73,7 @@ jobs:
           git config user.email "lockfile-bot@users.noreply.github.com"
 
           git checkout -B "$BRANCH"
-          git add pnpm-lock.yaml
+          git add pnpm-lock.yaml tests/runner-e2e/report-lock.json tests/runner-e2e/report-lock.patch
           git commit -m "chore(lockfile): refresh pnpm-lock.yaml"
           git push --force origin "$BRANCH"
 
@@ -80,10 +84,59 @@ jobs:
             head -n 1
           )"
           if [ -z "$pr_url" ]; then
+            pr_body_file="$RUNNER_TEMP/lockfile-pr-body.md"
+            cat > "$pr_body_file" <<'PR_BODY'
+          ## Thinking Path
+
+          > - Paperclip uses a dependency lock for reproducible builds.
+          > - Dependency changes on master need matching lock entries.
+          > - Paid eval reports also pin a reviewed offline correction.
+          > - Reports must install before paid model work starts.
+          > - This automated PR keeps the lock and report proof together.
+
+          ## Linked Issues or Issue Description
+
+          **What happened?**
+
+          Dependency manifests on master changed after the last committed lock refresh.
+
+          **Expected behavior**
+
+          Frozen installs must match those manifests. Eval reports must retain matching offline lock proof.
+
+          **Steps to reproduce**
+
+          Run a frozen install before and after this lock refresh.
+
+          ## What Changed
+
+          - Refresh the dependency lock from the manifests on master.
+          - Include the matching offline report correction and hashes.
+
+          ## Verification
+
+          - Pinned pnpm resolution completed with lifecycle scripts disabled.
+          - The report proof refresh accepted the reviewed committed baseline.
+          - Required PR checks and reviews must pass before merge.
+
+          ## Risks
+
+          Dependency changes require review. Unknown report lock baselines remain blocked. This update changes no permissions or paid enable gates.
+
+          ## Model Used
+
+          None — generated by pnpm and the deterministic report-lock updater.
+
+          ## Checklist
+
+          - [x] Thinking path and problem description included
+          - [x] Generated lock and matching report proof included
+          - [ ] Required CI checks and reviews pass
+          PR_BODY
             pr_url="$(gh pr create \
               --head "$BRANCH" \
               --title "chore(lockfile): refresh pnpm-lock.yaml" \
-              --body "Auto-generated lockfile refresh after dependencies changed on master. This PR only updates pnpm-lock.yaml.")"
+              --body-file "$pr_body_file")"
             echo "Created new PR: $pr_url"
           else
             echo "PR already exists: $pr_url"

.github/workflows/runner-full-stack-e2e.yml

@@ -196,9 +196,21 @@ jobs:
         with:
           node-version: 24
 
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        env:
+          NPM_CONFIG_AUDIT: "false"
+          NPM_CONFIG_FUND: "false"
+          NPM_CONFIG_UPDATE_NOTIFIER: "false"
+        with:
+          version: 9.15.4
+          run_install: false
+
       - name: Preflight reviewed report dependencies before paid admission
         run: node tests/runner-e2e/prepare-report-lock.mjs
 
+      - name: Validate report dependency manifests offline
+        run: pnpm install --lockfile-only --frozen-lockfile --ignore-scripts --offline
+
   target_lock:
     name: Resolve target pnpm lockfile
     needs: authorize