refactor(headless): move the benchmark identity out of the build a graded arm mounts

[Astro-Han]

What

A graded arm executes packages/headless/dist, so anything compiled into a shipped module is readable from inside the container being scored. harness-ab-manifest.ts carried each benchmark's pinned revision, task-tree fingerprint and full task list — 89 Terminal-Bench ids and 113 DeepSWE ids — and every one of them shipped.

That is the exact material of the #1970 incident: an arm read the pinned revision out of the mount, fetched the task's reference solution from the public repository at that revision, and recorded a pass that measured retrieval.

#2298 narrowed the mount so docs/eval and src no longer reach the container. It could not close this one, because the mount is a list of paths and the identity was inside a path the container legitimately needs.

How

• The data moves to packages/headless/harbor/benchmark-identity.json, loaded by harbor/benchmark-identity.mjs. Neither is mounted by any arm — agent-repo-mount.ts names exactly one file out of harbor/, and it is run-cell.mjs.
• harness-ab-manifest.ts keeps the assertions and loses the answers: assertTerminalBench21TaskSet and its three siblings become assertFrozenTaskSet(label, expected, actual) and assertFrozenTaskTreeFingerprint(label, expected, actual). Error messages are unchanged.
• Each entry in HARNESS_BENCHMARK_PROFILES now carries its own taskTreeFingerprint. With that, the DeepSWE-full and Terminal-Bench task-source branches were the same code under different names and collapse into one; only the subset-30 profile still differs, because its tree carries more tasks than the frozen set.
• No product module was affected — the identity was only ever read by the two host-side harbor/*.mjs entrypoints and by tests.

Verification

A new test in harness-ab-manifest.test.ts reads every shipped dist/*.js and asserts it contains no revision, no upstream URL and none of the 202 task ids. This is the first check on what the mounted files contain rather than on which paths are declared, and it immediately found a real leak: harbor-smoke-config.ts hardcoded '*sqlite-with-gcov' — a Terminal-Bench 2.1 task id — as a fallback the smoke manifest was already supplying. Removed, and it now fails loudly instead.

Red/green confirmed: restoring that literal fails the new test.

Loading the real entrypoint reproduces all three profiles byte-for-byte:

terminal-bench-2.1 d49e28f1 89 sha256:456826a
deep-swe-1.1       6db64a40 30 sha256:508aedc
deep-swe-1.1-full  6db64a40 113 sha256:973091a

npm run -w @maka/headless test — 1422 pass, 0 fail. Lint and format clean.

Known residue

Compiled tests under dist/__tests__ are still mounted and still mention individual task ids in fixtures. Closing that means splitting the test build out of dist, which is a cross-cutting change to every workspace's tsconfig and the test runner; a fixture id is also not the benchmark's identity in the way a pinned revision and a complete task list are. Left for its own change.

dist/terminal-bench-adapter.js remains readable and remains in the graded closure. It is genuinely needed to run, and what it reveals — a verifier grades by exit code — is generic harness mechanics rather than any task's answer.