fix: smoke journeys never run because export-ignored core files are expected in the release snapshot

[davidorban]

What was wrong

On a clean checkout, the smoke suite cannot run any journey that depends on a verified
release snapshot. task_lifecycle and every mcp_startup probe report:

UNKNOWN — not executed for safety (Dex-owned core differs from <ref>)

even though core has not been touched. It happens against any release ref, including one
pointed at the checkout's own HEAD commit, which is what rules out ref misconfiguration as
the cause.

The suite still exits successfully and prints OK for the journeys that do run, so a nightly
run reports success while covering a fraction of what it appears to. On my install that was
2 of 6 journeys, plus every MCP startup probe, silently not executing. I only noticed because
I went looking for why the nightly report seemed too clean.

Why

Two filters disagree about which files belong to the runtime core tree.

_materialize_release_core() builds the trusted snapshot with
git archive --format=tar <ref> -- core, which honours export-ignore from .gitattributes:

core/tests/             export-ignore
core/mcp/tests/         export-ignore
core/migrations/tests/  export-ignore
core/integrations/connection-manager/*.test.cjs export-ignore
core/integrations/connection-manager/hardening.child.cjs export-ignore

_release_execution_reason() builds the set of paths it expects to find in that snapshot from
git ls-tree, filtered by _is_runner_runtime_path(), which knows only about the three
directories. The last two entries cover 14 files that are therefore classified as runtime,
expected in the snapshot, and never present in it. snapshot.is_file() is false for each, so
the comparison returns Dex-owned core differs and every dependent journey skips.

Current main still shows the mismatch:

$ git ls-tree -r --name-only HEAD -- core \
    | grep -cE 'connection-manager/.*\.test\.cjs$|hardening\.child\.cjs$'
14

$ git archive --format=tar HEAD -- core | tar -t \
    | grep -cE 'connection-manager/.*\.test\.cjs$|hardening\.child\.cjs$'
0

The change

Two files, 39 added lines.

_is_runner_runtime_path() now also excludes *.test.cjs and
connection-manager/hardening.child.cjs, bringing it in step with .gitattributes. Those two
entries cover a test suite and a helper child process spawned by those tests, so excluding
them matches the intent already expressed by the three directories.

The regression test asserts that every path the runtime filter accepts actually survives
git archive. That keeps the two lists from drifting apart again, which seemed worth having
given the failure mode is a silent skip rather than a visible error.

Testing

• core/tests/test_smoke.py: 65 passed on this branch.
• Confirmed the new test fails on main without the fix, naming all 14 files, and passes with it.
• Ran the suite against a live install: task_lifecycle now passes, and the MCP startup probes
  execute and report real verdicts instead of skipping. The journey count went from 4 OK / 2
  UNKNOWN to 5 OK / 1 UNKNOWN / 0 BROKEN, with the remaining UNKNOWN entries being servers that
  are genuinely out of scope (Node-based rather than Python stdio, or targeting a file outside
  core/mcp/) rather than the skip this fixes.

One alternative I considered

The exclusions could be derived at runtime from git check-attr export-ignore instead of being
listed, which would never need updating when .gitattributes changes. I went with the explicit
list because it costs no subprocess call per run and does not let a future .gitattributes edit
quietly widen what the trusted comparison accepts. Happy to switch if you would rather have the
derived version.