fix: OptimizerV3.sol mutation has no CI guard (#631)

batch-eval.sh mutates OptimizerV3.sol by injecting Push3 candidates but
never restores it on exit. Add a backup/restore trap so the file is
always returned to its committed state, and add a CI step that fails
loudly if OptimizerV3.sol is left dirty after any pipeline step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -108,6 +108,19 @@ steps:
           echo "evolution.patch applies cleanly."
         '
 
+  - name: optimizer-not-mutated
+    image: registry.niovi.voyage/harb/node-ci:latest
+    commands:
+      - |
+        bash -c '
+          set -euo pipefail
+          if ! git diff --exit-code onchain/src/OptimizerV3.sol; then
+            echo "ERROR: onchain/src/OptimizerV3.sol has uncommitted mutations (likely left by batch-eval or inject.sh)." >&2
+            exit 1
+          fi
+          echo "OptimizerV3.sol is clean."
+        '
+
   - name: node-quality
     image: registry.niovi.voyage/harb/node-ci:latest
     environment:

tools/push3-evolution/revm-evaluator/batch-eval.sh

@@ -104,10 +104,19 @@ fi
 
 MANIFEST_DIR="$(mktemp -d)"
 
+# Back up OptimizerV3.sol so we can restore it on exit — batch-eval mutates
+# this file by injecting transpiled Push3 candidates (via inject.sh).
+cp "$OPTIMIZERV3_SOL" "${OPTIMIZERV3_SOL}.batch-backup"
+
 cleanup() {
+    # Restore OptimizerV3.sol to its pre-run state
+    if [ -f "${OPTIMIZERV3_SOL}.batch-backup" ]; then
+        cp "${OPTIMIZERV3_SOL}.batch-backup" "$OPTIMIZERV3_SOL"
+        rm -f "${OPTIMIZERV3_SOL}.batch-backup"
+    fi
     [ -d "${MANIFEST_DIR:-}" ] && rm -rf "$MANIFEST_DIR"
 }
-trap cleanup EXIT
+trap cleanup EXIT INT TERM
 
 IDS_FILE="$MANIFEST_DIR/ids.txt"
 BYTECODES_FILE="$MANIFEST_DIR/bytecodes.txt"