search-with-proof: path oracle covers the prefix-check-bypass class (sibling canary)

The path oracle only modelled classic parent traversal (a `canary` file in the parent of
${served_root}). A common real path-traversal class is the prefix-check bypass:
startswith(base) without a trailing separator, which the fix closes with base + os.sep;
it reaches a SIBLING whose path string-extends the served directory, not the parent.
PathOracle now also plants a sibling canary `public_leak` beside the served `public`
(same nonce, 0600), so a prefix-bypass demo leaks it on the vulnerable side and the fix
blocks it. ORACLE_GUIDE names the second target and tells the agent to pick the vector
its code shows. One shared nonce stays correct: a canary leaks only when the demo's own
request reaches it, and each demo targets one vector whose fix blocks it on the fixed side.

observe()/capture()/the differential/SideRecord are UNCHANGED. Local glance ceiling proof
still demonstrates (parent canary, 3/3 vuln, 0/3 fixed, control on both sides). Gate:
worker+control+verify suites 106 passed / 4 socket-skips; ruff clean; mypy clean on oracles.py.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/search/oracles.py

@@ -92,6 +92,10 @@ class PathOracle(OutputOracle):
         (canary.root / "public").mkdir()
         (canary.root / "canary").write_text(canary.nonce)
         (canary.root / "canary").chmod(0o600)
+        # Parent canary covers classic traversal; this sibling covers prefix checks
+        # using startswith without a separator.
+        (canary.root / "public_leak").write_text(canary.nonce)
+        (canary.root / "public_leak").chmod(0o600)
         # A benign in-root control file, distinct from the out-of-root secret, so a
         # correctly serving app returns it on BOTH revisions without any traversal.
         # Drawn from os.urandom, not secrets.token_hex, so it never perturbs callers