fix: verify packaged PI ownership boundaries

tests/unit/pi-product-artifact.test.ts

@@ -7,6 +7,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 
 import {
   assertNodeEngineCompatible,
+  classifyOpenCodeResourcePaths,
   collectAbsoluteManifestValues,
   collectForbiddenResourcePaths,
   defaultProductExecutable,
@@ -81,6 +82,15 @@ describe('final Pi product artifact verification', () => {
     expect(await collectForbiddenResourcePaths(root)).toEqual([
       'pi-runtime/node_modules/opencode-ai',
     ]);
+    expect(classifyOpenCodeResourcePaths([
+      'app.asar.unpacked/resources/opencode-runtime',
+      'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+    ])).toEqual({
+      productOwned: ['app.asar.unpacked/resources/opencode-runtime'],
+      upstreamPiProvider: [
+        'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+      ],
+    });
   });
 
   it('uses final unpacked-product paths and strictly parses verifier options', () => {