Issue 36425 evidence, real Pi executions

The base and head folders contain actual web-client CDP screencast frames,
read-only SQLite command events, half-second read-only samples and DOM output,
the exact prompt, CLI completion and summary. No replay or injected provider events.
The model generated test output by executing the requested shell command.
The environment selector's machine name is hidden for privacy; command output
and app behavior are untouched.

recording.mp4 is the actual CDP capture with original frame timestamps.
evidence.png combines an actual CDP screencast frame (left) with a separately drawn
read-only database observation (right), using the frame nearest that sample time. It is explicitly an annotated moving
capture, not a native app diagnostics panel. The original PNGs and JPEG frames
are included. The base and head viewports are both 1440x1000, dark theme.

Rebuild images and videos with Python/Pillow and ffmpeg:
  python3 render-evidence.py <unpacked-parent> <base-folder> <head-folder>
All files that the renderer reads are included in the archives.

Run the capture driver with Node 26 and installed checkout dependencies:
  node run.cjs <checkout> <web-port> <ready-thread-id> <new-output-directory>
The real dev server must have been started with T3CODE_DEV_SEED=0.
Enable the Pi instance in that checkout's settings and create an empty git project
through the project add CLI. Start a Pi thread using anthropic/claude-haiku-5-5
with the initial message "Reply only READY. Do not use tools yet."
EVIDENCE_TOOL=powershell selects the equivalent Windows PowerShell loop.
Default is the reporter's exact python3/bash command.

SQL grouping: event_type = 'turn-item.updated', payload type = 'command_execution',
group by payload id, count rows and sum/max length(payload_json).
Each run exports only its new command events. No live installation data was used.

Generated temporary tool-log paths in JSON are masked at the same length; event byte counts are unchanged. Final screenshots mask the same path.
