fix(artifacts): keep the post-snapshot detach check out of provenance

The inventory snapshot captures reader provenance before close() runs,
so a `hdiutil info -plist` entry recorded during cleanup never reached
CLI or MCP results. Detach entries already share that timing. Record
neither instead of implying the query is observable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/artifacts/NativeDmgArtifactReader.ts

@@ -141,14 +141,17 @@ export class NativeDmgArtifactReader implements ArtifactReader {
       );
   }
 
-  /** Report whether hdiutil still lists a device; unknown state counts as attached. */
+  /**
+   * Report whether hdiutil still lists a device; unknown state counts as
+   * attached. Like detach, this cleanup query runs after the inventory
+   * snapshot has captured provenance, so it is not recorded there.
+   */
   async #isAttached(device: string): Promise<boolean> {
     try {
       const info = await runChecked(this.host, ["info", "-plist"], undefined, {
         timeoutMs: DETACH_TIMEOUT_MS,
       });
       const parsed = infoOutputSchema.parse(parse(info.stdout));
-      this.#provenance.push(command(["info", "-plist"], ["read"]));
       return parsed.images.some((image) =>
         image["system-entities"].some(
           (entity) => entity["dev-entry"] === device,

tests/boundary/providers/native/nativeDmgArtifactReader.test.ts

@@ -201,7 +201,6 @@ describe("APFS disk image detach", () => {
       "verify",
       "attach",
       "detach",
-      "info",
     ]);
   });