Preserve agent accounting evidence in fallback artifacts

[dsyme]

Problem

The daily AIC conclusion can fail with missing agent accounting when the large, best-effort agent artifact upload is unavailable or incomplete. The existing agent-output-fallback artifact preserves safe-output files, but it does not include the compact accounting inputs consumed downstream.

This is distinct from the missing evals accounting fixed by #60869 and #60892. The remaining agent path can lose:

• execution evidence
• agent usage summaries
• firewall token-usage records

Without those files, the conclusion job cannot account for a failed agent job reliably. This was observed while following up on #60870.

Proposed fix

Include the compact agent accounting evidence in agent-output-fallback alongside the existing safe-output files, covering current and legacy firewall usage paths. Add compiler coverage for the generated artifact paths.

Acceptance criteria

• The fallback artifact includes agent execution evidence and engine usage summaries.
• The fallback artifact includes supported firewall token-usage paths.
• Generated workflow coverage verifies these files remain in the fallback artifact.

[dsyme]

Additional evidence from the gh-aw-test E2E run 34810867167, using gh-aw aa0cabfb259e with --use-samples:

• 17 safe-output mutation tests failed with the same activation error. Representative runs: add-discussion-comment and update-pull-request.
• The guardrail error was: Missing accounting for executed agent component ... conclusion success: agent/token_usage.jsonl is empty; agent_usage.jsonl is missing; agent_usage.json is missing.
• In one prior sampled run named by the error, 34804533121, the usage artifact exists and contains agent/token_usage.jsonl as a zero-byte file. Its agent-output-fallback artifact contains only agent_output.json and safeoutputs.jsonl. Because samples bypass inference, zero AIC is expected for this run.
• This reproduced on main and prerelease, while sampled tests passed on stable v0.88.7.

Important scope distinction for #61053: check_daily_aic_workflow_guardrail.cjs currently only selects artifacts named usage (PRIMARY_GUARDRAIL_ARTIFACT_NAMES = ["usage"]) and selects one artifact rather than merging accounting records from agent-output-fallback. Therefore adding accounting files to agent-output-fallback improves conclusion/downstream recovery when the large agent artifact is missing, but by itself does not fix the observed sampled-run daily-guardrail failures when a usage artifact exists with an empty token file.

A regression test should model a successful sampled agent with an existing usage artifact and empty token usage, and prove it accounts as zero rather than raising transient_error. The implementation could either preserve explicit sample/no-inference execution evidence in the primary usage artifact or teach the guardrail to consume/merge the compact fallback evidence.

[dsyme]

Addressed in #61053: the fallback now carries agent_execution.json, conclusion downloads merge it with the agent artifact, and the collector stages it as usage/agent/execution.json. Added regressions proving a successful sampled agent with empty token usage and same-attempt not_started evidence accounts as zero rather than producing transient_error.