Add output artifact sandbox receipts

[ictechgy]

Summary

• add contextguard-artifact:<id> output-sandbox receipts to artifact escrow metadata, including compact local-only summaries, claim boundaries, and bounded rehydration commands
• add context-guard-artifact receipt so agents can keep a compact handle and rehydrate exact sanitized slices without pasting full output
• wire output-sandbox receipts into digest --artifact-receipt output and repeated-failure nudge guidance, with custom artifact-dir redaction unless --show-paths is requested
• update docs in kit and plugin copies

Validation

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_context_guard_kit.ClaudeTokenKitTests — 560 tests OK
• python3 scripts/sync_plugin_copies.py --check — OK
• python3 -m py_compile context-guard-kit/context_escrow.py context-guard-kit/trim_command_output.py context-guard-kit/failed_attempt_nudge.py plugins/context-guard/bin/context-guard-artifact plugins/context-guard/bin/context-guard-trim-output plugins/context-guard/bin/context-guard-failed-nudge tests/test_context_guard_kit.py — OK
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/prepublish_check.py --skip-tests — OK
• python3 scripts/release_smoke.py --timeout 20 — OK
• PYTHONDONTWRITEBYTECODE=1 python3 scripts/prepublish_check.py — 694 tests OK + prepublish OK
• git diff --check — OK

Claim boundary

This is a local artifact receipt/output-sandbox workflow. It does not claim hosted API token or cost savings; omitted details must be rehydrated from local sanitized artifacts before relying on them.

[ictechgy]

G002 final verification summary:

Quad review R2: Codex APPROVE, Claude APPROVE, Forge APPROVE, Agy APPROVE. Blockers: none.

Final local validation on commit 3f166c0:

• sync_plugin_copies.py --check OK
• py_compile changed scripts/tests OK
• targeted custom-dir output sandbox test OK
• release_smoke.py --timeout 20 OK
• prepublish_check.py: 694 tests OK + prepublish OK

GitHub checks on amended PR: Python 3.11, Python 3.12, and macos-latest/Python 3.12 all pass.

Claim boundary checked: local artifact receipt/output-sandbox only; no hosted token/cost savings claim.