Make PromptKit profile handling safer and more consistent

internal/framework/llm/promptkit_client_test.go

@@ -429,6 +429,33 @@ func TestPromptKitClientCheckpointFingerprintTracksProfileSource(t *testing.T) {
 	if strings.TrimSpace(fresh[0].Value) == "" {
 		t.Fatal("built-in profile fingerprint is empty")
 	}
+
+	t.Run("directory layout", func(t *testing.T) {
+		profileDir := t.TempDir()
+		firstPath := filepath.Join(profileDir, "first-profile.yaml")
+		secondPath := filepath.Join(profileDir, "second-profile.yaml")
+		content := []byte("id: directory-profile\nendpoint: http://promptkit.test/v1\nmodel: directory-model\n")
+		if err := os.WriteFile(firstPath, content, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		first, err := promptKitProfileFingerprint(profileDir, "", "")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Rename(firstPath, secondPath); err != nil {
+			t.Fatal(err)
+		}
+		second, err := promptKitProfileFingerprint(profileDir, "", "")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if first == second {
+			t.Fatalf("profile-source fingerprint = %#v after source filename changed", first)
+		}
+		if strings.Contains(first.Value, firstPath) || strings.Contains(second.Value, secondPath) {
+			t.Fatalf("profile-source fingerprint exposes source path: %#v, %#v", first, second)
+		}
+	})
 }
 
 func TestPromptKitProfileFingerprintReadErrorsDoNotExposeSourcePaths(t *testing.T) {