fix: tighten agent patch hygiene

tests/test_policy.py

@@ -44,6 +44,22 @@ def test_rejects_protected_paths(settings, filename: str) -> None:
         validate_changes(workspace_with_no_symlinks(), summary, settings)
 
 
+@pytest.mark.parametrize(
+    "filename",
+    [
+        "config/erp_semantics.php.backup",
+        "app/Service.php.orig",
+        "test_debug.php",
+        "scratch.php",
+    ],
+)
+def test_rejects_temporary_artifacts(settings, filename: str) -> None:
+    summary = ChangeSummary((filename, "app/Fix.php"), 2, 0)
+
+    with pytest.raises(ValueError, match="Temporary artifact"):
+        validate_changes(workspace_with_no_symlinks(), summary, settings)
+
+
 def test_rejects_git_metadata_created_in_worktree(settings) -> None:
     workspace = workspace_with_no_symlinks()
     workspace.has_path.return_value = True