fix(coverage): prefetch locked Rust dependencies for offline evidence

[seonghobae]

Summary

• prefetches each locked Rust manifest from the exact pull-request merge tree before the coverage sandbox loses network access;
• uses a neutral runner-owned HOME/CARGO_HOME with GitHub credential variables removed and disables Git credential prompts;
• copies only Cargo's content-addressed registry/ and git/ caches into the reserved sandbox home, rejects PR-controlled collisions, and keeps offline coverage fail-closed;
• updates the runtime-boundary doctoring record, changelog, and contract/hash tests.

Root-cause evidence

ContextualWisdomLab/OriginWeave#210 at exact head 0341079331f9cea669eb9a5cc21842fd6027431e reproduced the central OpenCode coverage failure in dispatched run 33179004673, coverage-evidence job 98875118407: the networkless container attempted to resolve unicode-normalization from index.crates.io because no Cargo registry/git cache was materialized. The local OriginWeave Rust coverage proof was green; this PR repairs the central evidence boundary rather than weakening the gate.

Verification

• pre-update exact source head 135106c903da0bbf040d809dcf1147379b984020: focused central contracts/shell checks 33 passed, 1 skipped;
• pre-update central full suite excluding the pre-existing macOS-only stat -c sidecar tests: 1691 passed, 1 skipped, 17 subtests passed;
• pre-update git diff --check: passed; local Strix quick gate and full actionlint remain explicitly unclaimed because of the documented macOS fixture failure and timeout;
• the current branch includes the exact-head hardening commit 36ac3aa71b2580685f84d416a81e42c39dee927c, which disables Git credential prompts during locked-manifest prefetch; current exact PR head is 36ac3aa71b2580685f84d416a81e42c39dee927c;
• current-head review-thread query returns zero unresolved threads; fresh required checks and OpenCode approval are pending and must be evaluated only for 36ac3aa71b2580685f84d416a81e42c39dee927c;

No branch protection, review, coverage, security, or merge gate is bypassed.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 25 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f2ebf27-9060-4809-b8cf-79b9b67ea2e5

📥 Commits

Reviewing files that changed from the base of the PR and between e1b03ee and 36ac3aa.

📒 Files selected for processing (5)

• .github/workflows/opencode-review-dispatch.yml
• CHANGELOG.md
• docs/doctoring/opencode-rust-coverage-runtime-boundary.md
• tests/test_opencode_rust_coverage_toolchain_contract.py
• tests/test_pr_review_autofix_nvidia_nim_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}