ci(runner): retain Intel pack and stop on uncertain cleanup

Archive and verify the complete tested pack before startup checks. Make cleanup uncertainty sticky across test cases, retain scratch after interrupted launches, and enforce the reviewed 16 GiB seven-day artifact storage bound without truncation.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -202,11 +202,20 @@ jobs:
           python3 -B trusted-ci/scripts/ci/pi-intel/verify.py \
             --source "$GITHUB_WORKSPACE/candidate" \
             --output "$GITHUB_WORKSPACE/pi-intel-evidence"
-      - name: Retain exact input, independent output, test, and cleanup evidence
+      - name: Admit complete evidence within the reserved storage bound
         if: always()
+        id: pi_intel_evidence
+        timeout-minutes: 2
+        run: |
+          python3 -B trusted-ci/scripts/ci/pi-intel/admit_evidence.py \
+            --evidence "$GITHUB_WORKSPACE/pi-intel-evidence" \
+            --github-output "$GITHUB_OUTPUT"
+      - name: Retain exact input, independent output, test, and cleanup evidence
+        if: always() && steps.pi_intel_evidence.outputs.admitted == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: pi-native-intel-${{ github.run_id }}
+          include-hidden-files: true
           path: pi-intel-evidence/
           retention-days: 7
           if-no-files-found: error