fix(runner-e2e): resync the SDK lockfile pins to master's current lock (#20834)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work
> - The Runner support suite proves the plugin SDK public types from
pins in `tests/runner-e2e/source-sdk-public-inputs.json`
> - Two of those pins follow the root lockfile: the `pnpm-lock.yaml`
blob, and `lockSha256`, which must equal the `outputSha256` in
`tests/runner-e2e/report-lock.json`
> - The lockfile refresh #20824 changed the lockfile and
`report-lock.json`. The registry kept the old values
> - #20623 makes the refresh resync these pins, but its registry values
come from the refresh before #20824
> - The refresh resyncs only when it commits a lockfile change. The
lockfile is current, so the refresh after #20623 did nothing, and the
pins stay stale
> - This pull request regenerates the two pins with the existing
`--write` command
> - The benefit is that `ci / Runner support suite` passes again on
master and on new pull requests

## Linked Issues or Issue Description

Refs #20824. Refs #20623.

**What happened?**

`ci / Runner support suite` fails on master at `e2cf9a670f` and on pull
requests that merge master. `source-sdk-public-type.test.ts` and
`source-sdk-evidence.test.ts` fail with "Reviewed SDK reference policy
does not match public proof". `source-sdk-public-inputs.test.mjs`
reports `pnpm-lock.yaml (changed)`. The refresh run after #20623 merged
(run 43043576648) logged "Lockfiles and reporting-lock proof unchanged,
nothing to do".

**Expected behavior**

The registry pins the committed lockfile, and `lockSha256` equals the
`outputSha256` in `report-lock.json`.

**Steps to reproduce**

1. Check out master at `e2cf9a670f`.
2. Run `pnpm exec vitest run --config tests/runner-e2e/vitest.config.ts
tests/runner-e2e/source-sdk-public-type.test.ts
tests/runner-e2e/source-sdk-evidence.test.ts
tests/runner-e2e/source-sdk-public-inputs.test.mjs`.
3. See the "Reviewed SDK reference policy does not match public proof"
failure.

## What Changed

- `tests/runner-e2e/source-sdk-public-inputs.json`: regenerated with
`node tests/runner-e2e/source-sdk-public-inputs.mjs $(git rev-parse
HEAD) --write`. Only two values change:
- `inputs["pnpm-lock.yaml"]`: `6d825f97…` → `d24edac1…`, the committed
lockfile blob.
- `lockSha256`: `b3208306…` → `17625672…`, the `outputSha256` in
`report-lock.json`.
- No other pin changes. The lockfile and `report-lock.json` do not
change.

## Verification

- Before the change, the three SDK proof test files fail with the policy
mismatch. After the change, they pass.
- `pnpm exec vitest run --config tests/runner-e2e/vitest.config.ts
tests/runner-e2e/source-sdk-public-type.test.ts
tests/runner-e2e/source-sdk-evidence.test.ts
tests/runner-e2e/source-sdk-public-inputs.test.mjs
tests/runner-e2e/prepare-report-lock.test.ts`: 4 files, 68 tests pass.
- `node tests/runner-e2e/source-sdk-public-inputs.mjs $(git rev-parse
HEAD) --check` reports `changed: false`.
- Local run on macOS (darwin-arm64). Full regression is left to CI.

## Risks

- Low risk. The change is test data only, and it uses the values that
the registry command derives from the committed lockfile and the
reviewed `report-lock.json`.
- The same two values are in #20770. Whichever pull request merges
first, the other one merges cleanly.
- The refresh still resyncs these pins only when it commits a lockfile
change. If the pins become stale with no lockfile change, the refresh
does not repair them, and the support suite shows the failure and the
fix command.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

Claude Opus 5.5 (`claude-opus-5-5`), Anthropic, in Claude Code with tool
use (shell, file editing). Extended reasoning was used.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

tests/runner-e2e/source-sdk-public-inputs.json

@@ -530,12 +530,12 @@
     "packages/shared/src/worktree-seed-source.test.ts": "852856b1b5b8f4d0d3dada6501886fe50a2c2dde",
     "packages/shared/src/worktree-seed-source.ts": "3d1a09bed2d969feabef3400ff84fd499c1408f4",
     "packages/shared/tsconfig.json": "5a24989cd30dcf3749ca7e60d4e83d6ddbb14714",
-    "pnpm-lock.yaml": "6d825f9785f931f3bb08b0a6d2a741781f28f58a",
+    "pnpm-lock.yaml": "d24edac1c10355be138b35a0d0030f8d7fe14f5a",
     "scripts/ensure-plugin-build-deps.mjs": "356e0e0f80e50890067027da3003485cf5d2ccbe",
     "tsconfig.base.json": "2d0e41f723add0c678936eb9ae1c60eab710f8e0",
     "tsconfig.json": "994ee490fb97be7cc0954f4dfd88cf0723290e6c"
   },
-  "lockSha256": "b32083066ce89ba9a570a2927b3c4c8385294a5f04efcbae462db82b2e8c4455",
+  "lockSha256": "17625672b08d67bc1d69fd452dfd245508cafe38315a0eedb502ac27cb97e828",
   "compilerPackageSha256": "3722b30210616a13a3213ded11575ba6b2dbab10c32a5ef67afca8513e27017e",
   "parserPackageSha256": "6d6a65b879cd7cd249a4367c0b57cce00e78c728de45056ac2a5ca1d1f528d1a",
   "parserEntrySha256": "6969920ae0610df927b6b3e675d1309372c268e36d391652af8e3e0183cbe8f8",