pr_diff: ship oracle + verifier via tests/, not baked in image

[surajsharan]

Summary

• Close the reward-hack. pr_diff base64-baked the oracle patch, instruction, and verifier into /verifier/ in the agent's own image, so an agent could git apply /verifier/oracle.patch and score a perfect reward without solving anything. They now ship as tests/{oracle.patch, verifier.py, instruction.md} aux files, which Harbor uploads only at verify time — the exact plain-tests/ pattern pr_runtime has used since pr_runtime: graded F2P/P2P reward + 100-env dataset (Arc 2) #45, and the same class of fix as fix(code_instruct/equivalence_tests): grading test unreachable to non-oracle agents #55. The agent's image now contains the repo at base_commit and nothing else.
• Second, named change: the reward file is cleared before the verifier runs. pr_diff's test.sh had no guard, so an agent that broke python3 and pre-wrote /logs/verifier/reward.txt kept its value. test.sh now rm -fs the reward files first, mirroring Harbor's own separate-verifier empty_dirs([verifier_dir]). The verifier is the sole authority on the score.
• validate --deep now checks a runnable pr_diff task ships tests/{verifier.py, oracle.patch, instruction.md} (parity with the pr_runtime graded-verifier check), so a task that would build but score nothing is caught statically.
• Docs corrected: the layout blocks in pipelines/README.md and pr_diff.md, and RFC 0001, described the baked /verifier/ layout that this removes.

Test plan

• uv run --all-extras pytest -q — 1933 passed, 10 skipped (new/updated tests in test_pipeline_pr_diff.py, test_validation.py, test_pr_diff_clone.py)
• ruff check . + ruff format --check . clean; mkdocs build clean (0 warnings)
• repo2rlenv validate --deep passes on a freshly emitted task and flags one with the tests/ assets removed
• Leak reproduced on main, absent after (Docker Desktop / WSL2). On a task emitted with this branch's builders, the built image has no /verifier, no /tests, and no oracle.patch anywhere — find / -name oracle.patch is empty — so the git apply /verifier/oracle.patch exploit is impossible.
• End to end still scores 1.0. harbor run -a oracle -e docker on the fixed task → reward.txt = 1.000000, all deterministic components 1.0, judge_status: no_api_key (renormalized). The verifier runs correctly from the tests/ upload delivered at verify time.

Out of scope

• Existing published datasets. The change is generation-side; already-emitted pr_diff tasks (including AdithyaSK/repo2rlenv-pr-diff) keep their baked verifier and need re-emission to pick up the fix. A migration/re-bake tool could be a follow-up — and, since the verifier is now a plain tests/verifier.py file, upgrading it in place becomes a file swap rather than an image rebuild.
• The shared-verifier residual. The verifier still runs in the agent's container, so PYTHONPATH / sitecustomize / shadowed-binary tampering remains. The fix is Harbor's [verifier] environment_mode = "separate", a larger change worth its own discussion.
• Release-notes entry, left for the release cut.

Closes #144