fix: OptimizerV3.sol mutation has no CI guard (#631)

batch-eval.sh mutates OptimizerV3.sol by injecting Push3 candidates but
never restores it on exit. Add a backup/restore trap so the file is
always returned to its committed state, and add a CI step that fails
loudly if OptimizerV3.sol is left dirty after any pipeline step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -108,6 +108,19 @@ steps:
           echo "evolution.patch applies cleanly."
         '
 
+  - name: optimizer-not-mutated
+    image: registry.niovi.voyage/harb/node-ci:latest
+    commands:
+      - |
+        bash -c '
+          set -euo pipefail
+          if ! git diff --exit-code onchain/src/OptimizerV3.sol; then
+            echo "ERROR: onchain/src/OptimizerV3.sol has uncommitted mutations (likely left by batch-eval or inject.sh)." >&2
+            exit 1
+          fi
+          echo "OptimizerV3.sol is clean."
+        '
+
   - name: node-quality
     image: registry.niovi.voyage/harb/node-ci:latest
     environment: