Witness reads a pull request written by an AI coding agent, turns every claim into a check, and runs each check before and after the change inside throwaway sandboxes on Vultr.