test(ci): pin the exact upload path in the e2e retry contract (#11364)

Round 3's handoff pin closed the pack side but left the upload side
pinned to a directory prefix, so moving only the two upload with.path
values into a subdirectory of runner.temp kept the suite green while
the runtime upload found no file and redded the build job. Compare
first.with.path to the exact '${{ runner.temp }}/' + archive literal,
reusing the derived archive binding rather than restating the name.
Mutation probes: the upload-side drift now fails on the new assertion
(16/1, expected-vs-actual), the workspace-escape and pack-side drift
mutations stay red on their existing assertions, and the same
upload-side mutation under the old prefix assertion stays green —
the exact pin is the load-bearing one.

Also reword the overwrite rationale in both the workflow comment and
the test comment to the form the shipped action source supports: the
record is created before any bytes move, so a failed first attempt can
leave the e2e-build name taken, and overwrite is delete-then-upload
and a no-op when nothing exists. The previous wording asserted a
stall reserves nothing, which the create-then-upload lifecycle
contradicts. And name the retry contract's actual ungated siblings
(run-e2e-tests.sh's sandbox-image build retry,
build-and-publish-image.yml's image build retry) instead of the
budget-gated sandbox:none shard retry the comment over-claimed parity
with.

.github/scripts/e2e-build.test.mjs

@@ -486,10 +486,10 @@ describe('e2e build artifact upload retry (e2e.yml build job)', () => {
     // (its conclusion is success; only its outcome is failure), so the retry
     // would never run while a substring pin still reads green.
     assert.equal(retry.if, "${{ steps.upload-build.outcome == 'failure' }}");
-    // v4+ 409s a same-name upload only against an artifact finalized in
-    // this run attempt — a stall aborts before finalize and reserves
-    // nothing, so overwrite guards the finalize-then-fail window: an
-    // attempt that finalized e2e-build and only then reported failure.
+    // The action creates the artifact record before any bytes move, so a
+    // failed first attempt can leave the e2e-build name taken and 409 a
+    // same-name retry; overwrite is delete-then-upload and a no-op when
+    // nothing exists.
     assert.equal(retry.with.overwrite, true);
     // Both attempts publish the same payload under the same name; the
     // missing-archive guard rides on both so a pack regression fails
@@ -521,9 +521,10 @@ describe('e2e build artifact upload retry (e2e.yml build job)', () => {
       pack.run.includes('"${RUNNER_TEMP}/' + archive + '"'),
       'pack step must write the archive the upload publishes',
     );
-    assert.ok(
-      first.with.path.startsWith('${{ runner.temp }}/'),
-      'the upload must publish from the runner temp directory the pack step writes to',
+    assert.equal(
+      first.with.path,
+      '${{ runner.temp }}/' + archive,
+      'the upload must publish the exact file the pack step writes',
     );
     assert.ok(
       buildSteps.indexOf(pack) < buildSteps.indexOf(first) &&

.github/workflows/e2e.yml

@@ -87,20 +87,20 @@ jobs:
       - name: 'Pack build outputs'
         run: 'bash .github/scripts/e2e-build-pack.sh "${RUNNER_TEMP}/e2e-build.tar.gz"'
 
-      # One bounded retry, same contract as the sandbox image build and
-      # sandbox:none shard retries below: upload-artifact dying with
+      # One bounded retry, same ungated contract as the sandbox-image
+      # build retry (run-e2e-tests.sh) and the image build retry
+      # (build-and-publish-image.yml): upload-artifact dying with
       # "Upload progress stalled." is a transient runner-to-blobstore
       # network class — run 34208365262 stalled ten minutes on the ~100MB
       # archive and reded the whole run before any leg started. A
       # deterministic failure (missing archive, via if-no-files-found:
       # error) fails both attempts and keeps the job red. The first
       # attempt's continue-on-error keeps that failure from failing the
-      # job before the retry runs; the retry's overwrite covers the
-      # finalize-then-fail window: v4+ 409s a same-name upload only
-      # against an artifact already finalized in this run attempt, and
-      # a stall aborts before finalize and reserves nothing — but an
-      # attempt that finalized e2e-build and only then reported failure
-      # would 409 the retry without it.
+      # job before the retry runs; the retry's overwrite is
+      # delete-then-upload and a no-op when nothing exists: the action
+      # creates the artifact record before any bytes move, so a failed
+      # first attempt can leave the e2e-build name taken and 409 the
+      # retry without it.
       - name: 'Upload build artifact'
         id: 'upload-build'
         uses: 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' # v7.0.1