[TMHSDigital]

Fixes #43. Fixes #46.

#43: plumbline report mixed datasets.

• It took the dataset identity from the first artifact and rendered every arm under it. Runs over different datasets printed as if comparable (against dataset 02496ef4, 1 rows, 6 rows), and two runs of one adapter got identical ### mock headings.
• Different datasets are now refused, with the hashes named, unless --allow-mixed is passed. With it, the header says how many datasets there are and that they aren't comparable, and every arm names its dataset and row count.
• Arms that share an adapter name are told apart by model, then by run time.

#46: what leaves the machine in a shared file.

• Redaction: redact walked dicts only, so {"endpoints": [{"api_key": ...}]} reached the artifact. It now walks lists and tuples too.
• Paths: the report and the artifact named the dataset by the path as typed, so an absolute path shared a username and a directory layout. A dataset inside the working directory is now named relative to it, and one outside it by its file name. The dataset hash still says which rows they were.
• Backticks: a backtick in --model ended its code span early. A value in a code span now gets a longer fence when it contains one.

Checked

• New tests failed on main and pass now:
  • a key inside a list and inside a tuple is redacted;
  • different datasets are refused;
  • with --allow-mixed, both hashes are named;
  • two mock arms with different models get distinct headings;
  • we`ird renders as `` we`ird ``;
  • a dataset in a temp directory shows only as d.jsonl in the report and the artifact;
  • plumbline report refuses, then allows with --allow-mixed.
• ruff, mypy --strict, the full pytest suite, and the site build all pass. The example report is unchanged: its dataset path was already relative, and its one arm keeps its heading.

🤖 Generated with Claude Code