Pin clean Docker resolution and format binding regression

Verify identical lock digests from clean manifest resolution and its repeated resolution. Document the clean seed requirement.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docker/daytona-runner/Dockerfile

@@ -28,7 +28,7 @@ COPY cli/package.json ./cli/package.json
 # The complete resolved lock (including transitive integrity hashes) is reviewed.
 # Reject registry-time drift BEFORE installing packages or running lifecycle code.
 # Refresh this digest together with source/provider dependency changes.
-ARG PAPERCLIP_RUNNER_LOCK_SHA256=8eacabecdc38ad4351e0c482276489b1db468722c1c2abfdf8f406be1de1893b
+ARG PAPERCLIP_RUNNER_LOCK_SHA256=650e23d20e967bcfbfced888e131199b9a06e66a1ba4f64cfb68383b59def4a8
 RUN pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile \
     && printf '%s  pnpm-lock.yaml\n' "${PAPERCLIP_RUNNER_LOCK_SHA256}" > /tmp/provider-lock.sha256 \
     && sha256sum -c /tmp/provider-lock.sha256 \

docker/daytona-runner/README.md

@@ -105,6 +105,10 @@ verifies the downloaded artifact, then passes that artifact's SHA-256 as the
 `PAPERCLIP_RUNNER_LOCK_SHA256` build argument. The Dockerfile checks the resolved
 lock against this value before installation. The fixed Dockerfile default is
 for standalone builds; it must not replace a campaign's verified lock digest.
+Refresh the default from the clean tracked lockfile using the exact
+`pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile` command,
+and verify a second resolution preserves the digest. A lockfile left by a
+filtered or incremental install can retain stale importer patch identities.
 Keep one latest stable CLI installation per provider; refresh exact runtime
 versions and qualification digests together, never install a private older copy
 or download dependencies when a task starts.

packages/paperclip-runner/runner/crates/runner-core/tests/acpx_sidecar_transport.rs

@@ -233,7 +233,10 @@ fn assigned_gateway_binding_reaches_qualified_sidecar_without_unrelated_secrets(
                 "fixture-token-never-returned-in-test-output",
             )
             .env("UNRELATED_EVAL_SECRET", "must-not-cross-boundary")
-            .env("PAPERCLIP_ACPX_CREDENTIAL_BINDING", "controller-session-binding")
+            .env(
+                "PAPERCLIP_ACPX_CREDENTIAL_BINDING",
+                "controller-session-binding",
+            )
             .envs(
                 [
                     "ANTHROPIC_API_KEY",