Migrate troubleshoot fixtures to protected mocks

[dmorosanu]

Targets the driver-independent sandbox.protected_mocks in UiPath/coder_eval#90 (supersedes the earlier #87 docker-only dependency); merge that framework PR first.

Summary

• migrate all 297 uipath-troubleshoot scenarios from agent-visible data/m/r stores to private data/uip-fixture.json command maps
• use the driver-independent protected_mocks boundary (no sandbox.driver pin; the experiment config decides) and preserve docsai ask only as a narrow live passthrough
• remove the runtime dispatcher, seal, packed blobs, wrappers, and pre-run sealing hooks
• update scenario generation, command validation, coverage reporting, READMEs, and authoring guidance
• neutral default stderr for unmocked commands ({"error": "unmocked command"}) so agent-visible output does not identify the mock service
• fixtures use match_mode: subset (rule tokens must all appear in the invocation), sorted most-specific-first because subset dispatch is first-match-wins - chosen over finite normalized matching based on run data (below)

Security properties

• the evaluated agent receives only the bounded uip client shim; fixture files and mock implementation live host-side outside the agent workspace
• matching is a fixed recorded rule set: subset matching tolerates benign extra flags but never invents data - an invocation matching no rule receives the fixed default response
• tenant/job commands stay fixture-backed; only [docsai, ask] can reach the real CLI

Validation

• dry migration: 297 scenarios, 1,887 rules, 238 docsai passthrough configurations, no rule-key conflicts
• all 298 task schemas plan-validate against the coder_eval#90 harness; regenerated fixtures load through the harness's fixture loader
• run-validated on Windows driver: tempdir (5 real agent runs across activity-packages, products/orchestrator, cross-system, runtime-exceptions; 3 with docsai passthrough configured):
  • sandbox tree contains only the protected_mocks/uip shim - no m/, no .store, no fixture bytes anywhere agent-visible
  • protected_mock_calls.jsonl populated on every run (26-78 calls per task); note it requires an absolute --run-dir (relative paths break the shim-side log append - harness issue to follow up in coder_eval)
  • grading intact: skill_triggered and llm_judge produce sensible scores on all runs (0.625-1.0)
  • passthrough config validates at service start (uip 1.198.0 on PATH); no sampled agent issued a docsai ask, so the live proxy path itself is still unexercised

Matching mode: finite vs subset (resolved: subset)

Run data across the 5 sampled runs: 250 uip calls; 128 are the skill's own telemetry/preflight (track, login status), legitimately unmocked. Of the 122 real investigation calls under finite normalized matching, only 25 (20%) matched; 45 (37%) were near-misses - the recorded command plus benign extra flags agents add naturally (--output-filter, --limit, --level, --folder-key, --folder-path); 52 were genuinely unrecorded. Agents recovered by retrying bare forms, but each miss burns turns and diverges from the replayed session.

The corpus was therefore regenerated with match_mode: subset, rules sorted token-count-descending per fixture (most specific wins under first-match dispatch). Offline replay of all 379 recorded argvs from the validation runs against the regenerated fixtures, driven through the harness's own matcher:

• all 45 near-misses now match a rule (served-data coverage on investigation calls: 20% -> 57%)
• all 25 previously-matched calls match the same rule as before (no shadowing or losses from reordering)
• all 52 genuinely unrecorded calls (and all 129 telemetry/preflight calls) still receive the default response