fix(export): include renamed PoC base contract in output export allowlist

[jungjipdo]

What

The read-only output export allowlist was missing the PoC base contract file, so exported PoC bundles were not self-contained and failed forge build when rebuilt standalone.

Why

The engine renamed the PoC base contract file LumosPoCBase.sol → Base.sol. The generated PoC.t.sol now does:

import "./Base.sol";
contract AttackTest is Base { ... }

and the engine writes Base.sol on disk (deleting the legacy LumosPoCBase.sol).

The output export artifact allowlist (internal/artifacts/reader.go) was never updated for that rename — it still enumerated only LumosPoCBase.sol. Effect on every exported bundle:

• allowlisted LumosPoCBase.sol → reported as missing (engine no longer writes it)
• on-disk Base.sol → never exported (not allowlisted)

So the base contract the PoC imports is silently dropped, and rebuilding the exported project fails:

Error (6275): Source "test/Base.sol" not found
  --> test/PoC.t.sol:5:1:  import "./Base.sol";

Change

internal/artifacts/reader.go — add Base.sol next to each LumosPoCBase.sol entry, in both the default and export profiles, at both PoC locations:

• report_bundle/poc/Base.sol
• artifacts/agent_poc/foundry/test/Base.sol

Legacy LumosPoCBase.sol entries are kept → the change is purely additive and non-regressive: old cases that still carry the legacy file keep exporting it, new cases now export Base.sol, and absent files are still reported as missing (never an error).

Safety / blast radius

• No core logic touched. This is the read-only output-artifact allowlist only — the state machine, worker, bin/lumoskit dispatch, DB, and concurrency control are untouched.
• The export read path holds no locks shared with the worker and issues a single indexed single-row DB read, so it cannot preempt engine processing.
• Regression test added (TestECWReaderServesRenamedPoCBaseContract) asserting the export profile exposes Base.sol at both locations with the expected content.

Verification

• gofmt -l / go vet clean
• go build ./... OK
• go test ./internal/artifacts/... ./internal/api/... pass (incl. new test)
• Full suite: all relevant packages pass. The single unrelated failure (internal/lumoskit repo-root test) is a pre-existing macOS /var→/private/var symlink path artifact, identical to origin/main and not touched here.

🤖 Generated with Claude Code