[$25 BOUNTY] [Python] Add diagnostic bundle validation tests

[Peter7896]

Bounty: $25 (LT)

Area: build.py, diagnostic/, tests/

Current state: build.py generates encrypted diagnostic bundles for PR review, but there is no focused regression coverage that validates the generated JSON/logd contract, redacted metadata, and failure behavior.

What's needed: Add deterministic tests or helpers that validate diagnostic metadata and encrypted bundle references without relying on live services.

Acceptance criteria:

• Validate that a build run produces a matching diagnostic/build-*.json and diagnostic/build-*.logd reference.
• Assert diagnostic metadata uses repository-relative / paths where artifact paths are reported.
• Assert local home/repo/temp paths and usernames are redacted from diagnostic metadata.
• Fail clearly when the JSON is missing, the .logd reference is missing, or the pair is mismatched.
• Keep validation deterministic on Windows and Unix-like hosts.

Required validation:

• Run python3 build.py
• Include the generated diagnostic .logd artifact from diagnostic/build-XXX.logd; also include diagnostic/build-XXX.json if present
• Use .github/pull_request_template.md for your submission

[BERT70293]

i can take this one

[Ojas2095]

/claim

I'd like to take this on! Reviewing the repository right now and will submit a PR shortly.

[Nexussyn]

Bounty Submission — Runtime Open Federation

Payment address (USDC on Base): 0xb438d36b425b504724a1c72aa0941c80cb940995
We can complete this task and deliver within 24h. Please assign to confirm.

[Peter7896]

Thanks for the interest. This issue tracks an upstream LT bounty requested from lobster-trap/Kickama#43.

Please open a PR against the upstream repository, reference this issue, follow .github/pull_request_template.md, run python3 build.py, and include the generated matching diagnostic/build-*.json plus diagnostic/build-*.logd pair.

I cannot assign or guarantee payment directly; bounty eligibility and payout are determined by the upstream maintainer/tracker after review and merge. No payment address is needed here before an upstream PR is reviewed.