fix(daemon): mirror evidence into the home holding the run's lease

[chubes4]

Part of #7505.

The lease and its evidence resolved separately

exec_via_daemon opens a store to hold the run's lease:

let lease_store = run_id.as_deref().map(|_| ObservationStore::open_initialized()).transpose()?;

and later mirrors that run's evidence:

mirror_daemon_evidence(request)   // opened its own store from the environment

Two independent resolutions for one execution. The comment already sitting above the lease states the invariant plainly:

a lease claimed against one home and released against another leaves the source stuck running with nothing alive holding it (#7505)

Evidence for the same run had no equivalent guarantee. A repoint between the two — or any caller that later hands exec_via_daemon injected roots — puts the lease in one installation and the artifacts, job runs, and terminal status describing it in another. The run then looks abandoned in the home that holds its lease, while its evidence sits somewhere nobody is reading.

Fix

exec_via_daemon resolves once and shares:

let roots = homeboy_core::paths::PathRoots::from_environment()?;
let lease_store = run_id.as_deref()
    .map(|_| ObservationStore::open_initialized_in_roots(&roots))
    .transpose()?;
...
mirror_daemon_evidence(request, &roots)

mirror_daemon_evidence takes the roots rather than resolving its own. It has one production caller.

A note on how the test edits went

I inserted the new argument at three test call sites with a paren-matching script, which placed it after an existing trailing comma at one of them:

    .with_generic_runner_exec_run(),
, &test_roots())

cargo check --workspace --tests -j2 caught it (expected expression, found ,) and it is fixed. Worth recording because the two other sites had a different shape and were fine — a script that is right twice can still be wrong once, which is the argument for running the gate rather than trusting the edit.

Verification

cargo check --workspace --tests -j2 — clean, 3m20s, zero errors.

Remaining in this file

evidence/mirror.rs still has seven ambient entry points (mirror_reverse_broker_evidence, mirror_daemon_job_progress, refresh_mirrored_daemon_evidence, and others). Each is reachable from a different caller, so they want their own increments rather than one sweep — this one is the pair where the split was demonstrably load-bearing.

[homeboy-ci]

Homeboy Results — homeboy

Lint

✅ review lint — passed

ℹ️ Full options: homeboy self docs commands/lint
ℹ️ Save lint baseline: homeboy review lint homeboy --baseline
Deep dive: homeboy review lint homeboy --changed-since 7e1a0bd

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-homeboy-review-lint-homeboy-fast-Linux contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-homeboy-review-lint-homeboy-fast-Linux contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/homeboy/actions/runs/32545682029

Audit

✅ review audit — passed

Deep dive: homeboy review audit homeboy --changed-since 7e1a0bd

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-homeboy-review-audit-homeboy-fast-Linux contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-homeboy-review-audit-homeboy-fast-Linux contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/homeboy/actions/runs/32545682029

Tooling versions

• Homeboy CLI: homeboy 0.351.3+4ba244de9770
• Extension: rust from https://github.com/Extra-Chill/homeboy-extensions
• Extension revision: 410c146a
• Action: unknown@unknown