Protect captured prompt configuration files

internal/framework/llm/runtime.go

@@ -24,9 +24,9 @@ type Runtime struct {
 	Config   config.Config
 	Engine   *pk.Engine
 	Profiles map[string]pk.ProfileInspection
-	// ProfilePaths contains filesystem sources actually read by PromptKit.
-	ProfilePaths []string
-	nextCallID   atomic.Uint64
+	// SourcePaths contains host configuration and message files captured by PromptKit.
+	SourcePaths []string
+	nextCallID  atomic.Uint64
 }
 
 // AssetError indicates a broken embedded prompt or schema rather than an
@@ -125,6 +125,10 @@ func newRuntimeWithPromptFS(ctx context.Context, c config.Config, mainPath strin
 		}
 		runtime.Profiles[selection.role] = *profile
 	}
+	runtime.SourcePaths, err = capturedSourcePaths(engine)
+	if err != nil {
+		return nil, fmt.Errorf("inspect captured LLM sources: %w", err)
+	}
 	return runtime, nil
 }