[ITSGJY]

Summary

• Add project_format for 1–8 explicitly selected Rust/Python files under one Runner-resolved recipe root, using fixed rustfmt or isolated Ruff stdin/stdout candidate generation.
• Guard source and scope authority with closed planning, manifest and file identity witnesses, fresh admission/worker fences, and compare-before-write verification. Multi-file mutations are not atomic.
• Preserve a single durable Runner Job, three-state mutation evidence, permission/capability gates, and original-Job observation/recovery. Uncertain effects never authorize automatic replay.

Local validation

• cargo test -p webcodex-core project_format: 7 passed
• cargo test -p webcodex-runner project_format: 32 passed
• cargo test -p webcodex project_format: 8 passed
• cargo test -p webcodex-tool-contracts: 297 passed
• cargo test -p webcodex-runner-registry: 347 passed
• cargo fmt --check: passed

Related to yyjeqhc#962. Review the native CI matrix on this candidate.