fix(portfolio): exclude backup evidence from discovery

[saagpatel]

Summary

• classify exact Codex Backups containers as backup evidence, alongside existing generated and temporary exclusions
• emit stable workspace_discovery.v1 exclusion counts in portfolio truth
• add CL-EXCL-001 to reject excluded paths that leak into portfolio projects
• preserve legitimate nested project discovery

Verification

• uv run ruff check .
• uv run pytest -q: 2855 passed, 2 skipped
• current canonical artifact fails CL-EXCL-001 on exactly the leaked Wave 2R backup path
• focused fixtures prove Codex Backups is excluded while Documents/RealNestedProject remains discoverable

Boundaries

• no canonical truth regeneration
• no scheduler activation, LaunchAgent change, bridge write, or Notion write

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc51f9c3d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scan project paths even when exclusions are missing

When contract-shadow checks an artifact that predates or accidentally drops the new exclusions envelope, this early return prevents the later projects[].identity.path scan from running. In that case a truth file can still contain a path like Documents/Codex Backups/..., but CL-EXCL-001 is reported only as an unknown envelope issue so passed remains true instead of rejecting the leaked backup project; scan for leaked excluded path parts before returning for the missing envelope.

Useful? React with 👍 / 👎.