Add tests for report command JSON output

[Garifallos]

What this changes

The grounding invariant

The LLM never publishes anything a fresh container didn't independently
execute. Grounding is enforced in code, not prompts.

• This change does not let an unverified command reach tutorial.md,
  step_by_step.md, commands.sh, or the demo tape — or it adds a
  code-level check (not just a prompt rule) that keeps that true.
• Sandbox hardening flags in sandbox.py are unchanged (or the change is
  explicitly discussed in the PR body).

Tests

• python -m pytest tests/ -q passes locally.
• Bug fixes carry a regression test named for the failure/run that found it.
• parse_transcript / normalize.py changes stayed pure and
  deterministic (no LLM calls; testable against fixtures).

Prompt changes (if any)

• N/A — this PR doesn't touch prompts/*.md.
• Included a before/after transcript or run report as evidence.

Housekeeping

• One concern per PR.
• Type hints + docstrings on new/changed public functions.
• If stages or boundaries moved, architecture/README.md and CLAUDE.md
  are updated to match.

[alphacrack]

nothing to merge, empty PR

[alphacrack]

Thanks for this contribution — the test made it in and did its job. Two things happened since: the last "Merge branch 'main' into patch-2" resolved to main's tree wholesale, so this PR now carries an empty diff (merging it would change zero files), and the report --json repair in #79 (v0.6.0) replaced the original test with a stronger regression test over a populated manifest — the original asserted cost == 0.0 on a manifest recording cost 1.50, which is exactly how the #29 breakage slipped past CI. Recommending close as superseded: the work itself shipped in v0.6.0. 🙏