Finalization-only cleanup gate for provisional shell scratch artifacts

[mmprotest]

Motivation

• Remove disposable files created by model-driven shell probing that are left behind after a successful run while avoiding interference with verification or source artifacts.
• Implement a tiny, conservative finalization hygiene step that only runs after visible/post-execution validation succeeds and is fully reversible.

Description

• Track provenance at the runner tool boundary by snapshotting repo files before/after Bash tool execution and adding after - before to runner._provisional_scratch_candidates, while recording explicit Write/Patch targets in runner._non_scratch_created_files so they are excluded from cleanup (changes in villani_code/state_tooling.py).
• Add runner fields (_provisional_scratch_candidates, _non_scratch_created_files, _cleanup_telemetry) and a single finalization call site in the successful path inside _finish_bounded that invokes _cleanup_provisional_scratch_after_success after post-execution validation (changes in villani_code/state.py).
• Implement _cleanup_provisional_scratch_after_success(...) which conservatively filters eligible candidates (existence, regular file, inside repo, not Write/Patch-created, not under detected source/test/package roots, and requires repo root confidence), backs up bytes/mode, removes candidates, reruns verification using the existing self._run_verification path, and restores files on failure or error; it records telemetry fields into the runner debug summary payload (changes in villani_code/state.py).
• Add focused unit tests in tests/test_finalization_cleanup.py to verify removal-on-pass, restore-on-fail, and protection of files under src/ and tests/.

Testing

• Ran the new test suite pytest -q tests/test_finalization_cleanup.py and all tests passed.
• Ran targeted existing tests pytest -q tests/test_loop.py::test_run_injects_diagnosis_hint_into_existing_prompt_context and pytest -q tests/test_trace_runtime_path.py::test_real_bash_execution_emits_canonical_tool_lifecycle and both passed.
• The change is intentionally minimal with a single cleanup call site and preserves the existing verification and execution paths; automated tests above succeeded.

---

Codex Task