fix: preserve receipt artifact closures

[bobaikato]

Fixes receipt baseline restoration when an archived receipt references a contract snapshot that the Action did not upload.

• Upload every declared local artifact in the current receipt closure, including the immutable contract snapshot.
• Reject unsafe, missing, non-file, or symlink-escaped closure paths.
• Treat historical incomplete artifacts as unavailable baselines, then publish a fresh current receipt rather than attempting an unverifiable comparison.
• Preserve the current archived receipt payload separately from later receipt-diff output.
• Disable PR comments in the token-free smoke fixture so it tests action execution rather than unrelated GitHub write permission.
• Bump the Action to v1.0.16, so the post-merge release moves ota-run/action@v1 to this repair.

No Ota contract semantics change.

Validation: npm test (47/47), released ota v1.6.28 ota run build --agent --concise, ota run ci --agent --concise, and independent MUSE review with no remaining P1/P2/P3 findings.

[github-actions]

ota receipt diff

Baseline source: file
Compare: ota.yaml (READY) -> ota.yaml (READY)
Drift: identity unchanged; readiness unchanged
Counts: introduced 0 (errors=0, warnings=0, info=0); resolved 0 (errors=0, warnings=0, info=0); unchanged 9 (errors=0, warnings=9, info=0)
Gate: fail on new blockers -> passed

Action references

• Command: /home/runner/.cargo/bin/ota receipt --json --baseline /home/runner/work/_temp/ota-baseline-lJFjNk/.ota/receipts/repo-receipt-20260717-154706-443Z.json --fail-on-new-blockers --mode native .
• Output JSON: /home/runner/work/action/action/.ota-action-output.json
• Current archive: /home/runner/work/action/action/.ota/receipts/repo-receipt-20260925-194628-076Z.json
• Artifact: ota-readiness in this run