Fix nested checkup drift input resolution

[Serhan-Asad]

Summary

• resolve pdd checkup drift inputs through one guarded boundary that accepts contained explicit prompt paths or searches active .pddrc prompt roots
• make explicit --code-file authoritative before manifest/default code derivation
• preserve path-qualified prompt identity when deriving code without --code-file, preventing sibling same-leaf contexts from selecting the wrong artifact
• fail closed on prompt ambiguity, resolver prompt mismatch, and project-root escapes while matching language suffixes case-insensitively
• emit stable structured JSON errors and suppress the root onboarding reminder in machine-JSON mode
• preserve existing flat prompt and manifest behavior

Addresses #2001.

Sibling #2000 remains separately scoped: this change contains no Makefile or extensionless-artifact special case and does not address its pdd update behavior.

Duplicate and reuse audit

• Honor architecture.json filepath for prompts in nested .pddrc contexts #1976 / PR Honor architecture.json filepath for prompts in nested .pddrc contexts #1971 harden architecture-owned prompt/output resolution, but their current head still reproduces the exact drift CLI failure.
• checkup repair resolves owning prompts against pdd's self-hosted layout instead of the target repo's prompt layout (refuses repair on all external repos) #1957 / PR Bundle: checkup resilience — auto-degrade, target-repo prompt paths, test adoption (#1941, #1957, #1903) #1962 concern repair-loop prompt ownership, not drift dev-unit resolution.
• No other open or closed PR implementing the checkup drift cannot resolve nested subproject prompt with explicit code file #2001 contract was found. This implementation reuses get_pdd_file_paths for derived code paths instead of adding repository-specific mapping logic.

Validation

• focused drift and root CLI neighborhood: 134 passed
• resolver, construct-paths, evidence-manifest, and evidence CLI neighborhood: 337 passed
• post-format drift CLI suite: 18 passed
• pdd_cloud prompt/code consumer alignment suite: 7 passed
• Ruff changed-file check and format check pass
• git diff --check and syntax compilation pass
• focused mypy reports only the pre-existing pdd/drift_main.py:1017 diagnostic; no diagnostic points to the new resolver code
• official calculate_current_hashes matches the stored core/cli prompt hash, code hash, and include dependencies

Real pdd_cloud E2E from extensions/github_pdd_app with this branch first on PYTHONPATH:

pdd checkup drift prompts/src/pdd_issue_runner_job_Python.prompt \
  --code-file src/pdd_issue_runner_job.py --dry-run --json
status=stable; tests=passed 1/1

pdd checkup drift pdd_issue_runner_job \
  --code-file src/pdd_issue_runner_job.py --dry-run --json
status=stable; tests=passed 1/1

pdd checkup drift prompts/src/services/pdd_issue_goal_session_Python.prompt \
  --dry-run --json
status=stable; code_path=src/services/pdd_issue_goal_session.py; tests=passed 1/1

No provider-backed PDD command or authentication repair was used.

[Serhan-Asad]

Intent

Make pdd checkup drift resolve the exact prompt/code pair named by the caller across nested .pddrc subprojects: explicit prompt paths are accepted, explicit --code-file stays authoritative, derived paths preserve prompt context, ambiguous or escaping inputs fail closed, and --json remains machine-parseable.

Failure modes

1. Trigger: two contexts contain the same prompt leaf and the caller supplies the frontend prompt path without --code-file. Failure: leaf-only derivation can silently test the backend artifact and report a false stable result. Evidence: pdd/drift_main.py:380-425 now carries the path-qualified basename, verifies resolver prompt identity, and refuses flat fallback for qualified prompts; tests/commands/test_drift_cli.py:275-372 covers both correct sibling selection and missing-context-code fail-closed behavior.
2. Trigger: a bare dev-unit basename matches prompts in multiple active roots. Failure: first-match behavior could choose the wrong prompt/code pair and produce misleading drift evidence. Evidence: pdd/drift_main.py:343-375 collects all physical matches and raises drift_input_ambiguous; the ambiguous-basename CLI regression asserts both choices are surfaced.
3. Trigger: an explicit prompt or code path uses an absolute path, .., or symlink resolving outside the project. Failure: drift could read or execute tests against files outside the intended repository. Evidence: pdd/drift_main.py:193-216 resolves and containment-checks every explicit file before use; dedicated prompt and code escape tests assert drift_input_outside_project.

Performance

Explicit prompt paths perform bounded config/root checks and direct filesystem resolution. Bare or path-qualified basenames scan active prompt roots with rglob at pdd/drift_main.py:343-359, so lookup is O(number of prompt files); overlapping physical roots are deduplicated at lines 257-265. No network call, subprocess, lock, event-loop work, or repeated scan was added to a hot request path—this is a one-shot operator CLI before the existing, much heavier drift evaluation.

Verdict: ready. The exact pdd_cloud explicit-code, basename, and no-code nested paths are stable; 134 focused tests, 337 resolver/evidence neighbors, 7 consumer alignment tests, Ruff/format/diff/compile, and official metadata verification pass. No provider/auth path was touched.