fix(retention): match the encoded workspaces root at a path boundary (#227)

is_agent_owned_dir used a bare startswith on the encoded workspaces root, so a
sibling root that shares the prefix (e.g. -data-workspaces2 vs -data-workspaces)
was misclassified as agent-owned and its operator transcripts pruned. Require an
exact match or a '-' path-boundary prefix.

Supersedes #221 (the same fix from antfleet-ops, who flagged the over-match);
re-done here as our own change so it can land without the contributor CLA.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/runtime/test_transcript_retention.py

@@ -38,6 +38,16 @@ def test_is_agent_owned_dir_matches_app_and_workspaces() -> None:
     assert is_agent_owned_dir("-home-renzof-code", WORKSPACES) is False
 
 
+def test_is_agent_owned_dir_rejects_sibling_root_prefixes() -> None:
+    # A sibling workspace root that merely shares the encoded prefix without a
+    # "-" boundary must NOT be treated as agent-owned, else operator transcripts
+    # under it get pruned. Encoded root here is "-data-workspaces".
+    assert is_agent_owned_dir("-data-workspaces", WORKSPACES) is True  # exact
+    assert is_agent_owned_dir("-data-workspaces2", WORKSPACES) is False
+    assert is_agent_owned_dir("-data-workspaces2-project", WORKSPACES) is False
+    assert is_agent_owned_dir("-data-workspacesBackup-x", WORKSPACES) is False
+
+
 def test_is_agent_owned_dir_handles_root_slash_safely() -> None:
     # A pathological "/" workspaces root must not make every dir agent-owned.
     assert is_agent_owned_dir("-Users-renzof-secret", "/") is False