Corrección: feat(cli): name failing assets and drift cause on actor_guidance_unverified refusals (#383) #384

Source PR: #383
Branch: fix/373-update-guidance
Head reviewed: 40a26ef

Push the fixes to the branch above; do not open a new pull request. Comment on the PR and on this issue when done.

Blocking findings

• Evidence-stage refusal hides content drift when an asset also drifted in mode (internal/installcoord/actor_guidance.go:215): In recordedDriftAssets the switch tests case asset.ModeDrift: first, so an asset whose bytes differ from the recorded digest AND whose mode differs gets Cause=ModeDrift and the content-drift check is never evaluated. The CLI renderer (internal/cli/update.go, actorGuidanceRefusalAssets) then prints only cause=mode_drift observed_mode=... canonical_mode=... for that asset — no indication the bytes also drifted. This contradicts the PR body's claim that mode_drift 'also fires for content-drifting assets whose mode also drifted: both facts are reported', and it contradicts the invariant the same PR pins for the conflict path (TestUpdateGuidanceRefusalNamesContentAndModeDrift keeps cause=content_drift plus mode facts). The real-world install/uninstall/update ownership conflicts fail closed without naming the conflicting asset paths or drift cause #373 scenario (externally authored agents/cortex-.md under unadopted/registered guidance, typically not 0600) runs through exactly this evidence stage. No test covers the combined content+mode case on the evidence stage.
  • Failure scenario: A Pi actor guidance file has bytes appended by an external editor and its mode is 0640 (canonical 0600). cortex update --runtime pi refuses with only asset=actors/<role> path=... cause=mode_drift observed_mode=0640 canonical_mode=0600; the content drift is invisible. The operator chmods 0600 as instructed, re-runs, and is refused again — now with cause=content_drift — reintroducing the multi-round guessing that issue install/uninstall/update ownership conflicts fail closed without naming the conflicting asset paths or drift cause #373's expected outcome ('the output names which file failed verification and why: content drift vs mode drift') exists to eliminate.

Acceptance criteria

• Fixed: Evidence-stage refusal hides content drift when an asset also drifted in mode (internal/installcoord/actor_guidance.go:215). The scenario below no longer reproduces: A Pi actor guidance file has bytes appended by an external editor and its mode is 0640 (canonical 0600). cortex update --runtime pi refuses with only asset=actors/<role> path=... cause=mode_drift observed_mode=0640 canonical_mode=0600; the content drift is invisible. The operator chmods 0600 as instructed, re-runs, and is refused again — now with cause=content_drift — reintroducing the multi-round guessing that issue install/uninstall/update ownership conflicts fail closed without naming the conflicting asset paths or drift cause #373's expected outcome ('the output names which file failed verification and why: content drift vs mode drift') exists to eliminate.