An archival video of all coding sessions (locally, hosted by the student), starting with a visible outline of pseudo-code and ending with debugging should be sufficient.
In case of a false positive from a faulty detector this is extraordinary evidence.
We had a professor require us to use git as a timestamped log of our progress. Of course you could fake it but stealing work and basically redoing it piece by piece with fake timestamps is a lot of work for cheaters.
In case of a false positive from a faulty detector this is extraordinary evidence.