#2479 swamp-extensions verify-build: codegen guards read stdout from the shell log file resource and now fail every run

Problem

In the swamp-extensions repo, verification/workflow-verify-build.yaml guards both codegen steps (around lines 312 and 337) with:

data.latest('build-detect-' + run.id, 'log').attributes.stdout.contains('CHANGED_CODEGEN: true')

The command/shell model writes log as a streaming plain-text file resource (contentType: text/plain, no attributes). It has done so since swamp core c07cd86a (February), before this workflow was added. stdout is on the step's result resource (JSON: exitCode, executedAt, command, durationMs, stdout, stderr).

With swamp 20260924.122519.0-sha.5f802bc0 the guard now throws instead of evaluating to false, and the whole workflow fails:

InvalidExpressionError: Invalid expression: No such key: stdout
> data.latest('build-detect-' + run.id, 'log').attributes.stdout.contains('CHANGED_CODEGEN: true')

Every other step passes. Seen on run 6982a928-8ea5-42ee-9420-b42d0b8940bf (verifying swamp-club#2404, commit 3d06ec2c6). Every swamp-extensions verification that reaches this job is affected, whether or not codegen changed, so no PR can produce a passing verify-build.

The guard has always read the wrong resource. It presumably used to evaluate missing keys to false, which would also mean codegen-verify never ran even when codegen changed. I have not pinned down which recent core expression change made it throw; that part is unconfirmed.

Suggested fix

Read stdout from result instead of log in both guards:

data.latest('build-detect-' + run.id, 'result').attributes.stdout.contains('CHANGED_CODEGEN: true')

Check any other verification/ expressions that read .attributes from a shell step's log. This is a trust-root change, so it goes through the CI security review.

Related

• swamp-club#2404 (blocked on this for its pre-PR verification)