Prevent checkpoint snapshots from recursively capturing artifact directories

## Problem

A recipe runtime whose `artifactsDirectory` is inside the working tree creates checkpoint snapshot artifacts under that directory. Restoring those checkpoints materializes the configured artifact tree into the runtime snapshot payload; later artifact collection emits a nested `artifacts/...` tree containing sibling runs, manifests, request-worker files, and snapshots. Parent bundle verification then reports those files as orphaned.

## Evidence

Confirmed while completing #2017 with one immutable checkpoint baseline per campaign. The final finding bundle's manifest correctly lists all six adversarial nested bundles, but `artifacts verify --bundle ` reports the recursively captured `artifacts/wordpress-adversarial-vulnerable/...` tree and checkpoint snapshots as orphaned. The standalone artifact verifier smoke passes.

## Expected

Checkpoint snapshot capture/restore must exclude host artifact storage by construction. Do not solve this with post-hoc deletion; preserve snapshot restore semantics and manifest integrity.

Refs #2017

Inizia tracciando l’acquisizione e il ripristino degli snapshot del checkpoint quando artifactsDirectory si trova all’interno dell’albero di lavoro, quindi segui il modo in cui la raccolta degli artefatti crea il bundle finale. Riproduci lo scenario dell’issue ed esegui `artifacts verify --bundle `; il lavoro è completato quando l’archiviazione degli artefatti dell’host viene esclusa senza eliminazione post-hoc, mentre la semantica del ripristino degli snapshot e l’integrità del manifest rimangono intatte.

Scritto dal modello di indicizzazione a partire dal testo della issue.