Stage trusted lineage persistence and semantic publication

[jeffhuber]

Adds staged APIs for persisting verified builder handoffs and same-writer continuations, preserving transport attribution, and checking complete authenticated publication readback before reconciling the active builder label. The producer workflow and runner are packaged separately; coordinated adoption by existing consumers belongs to #992.

Artifact tests build a local wheel with pip, install it in an isolated target, and execute the rendered workflow and runner against the installed producer API. An embedded accepted-base baseline verifies existing code and asset parity without requiring Git history, including depth-one CI checkouts. Normal-init import isolation is covered separately.

Validation: owning, affected and core unittest suites; full unittest discovery; isolated wheel and shallow-checkout rehearsals; Ruff, privacy, workflow, manifest and release-readiness checks. Independent exact-head Claude review passed with no P0/P1/P2 findings.

Authored by Codex through Code Mower; independently reviewed by Claude.

Closes #991
Refs #963

[jeffhuber]

CI at 49f66295e8036ec3f777e01edadc56436e799273 failed the new artifact test setup on Python3.12/3.13/3.14 because the unit-test environment has pip but not the separate build frontend. The canonical local preflight passed, but that did not establish CI compatibility. The sole broad local run was cancelled and drained after the confirmed CI failure; no full-suite pass is claimed.

One same-Codex correction is authorized, bounded at480seconds/8MiB with unchanged configured settings and containment. Only the owning artifact test may replace python-mbuild with python-mpip wheel --no-deps --wheel-dir against the local candidate. The real isolated build, one-wheel installation, candidate-origin checks, fixture rows, product/core and all guards remain intact. No CI/dependency changes or automatic retry. After source delivery, broker checks and a fresh frozen-head qualification are required; this draft remains unaccepted.

[jeffhuber]

CI at 4b906f140e7a41074a4f054a9e87934556eefcac now builds the candidate wheel successfully. Two parity checks still require an accepted-base Git object that the default shallow CI checkout does not contain. The corrected local full run was cancelled and drained after this confirmed CI dependency; no full-suite pass is claimed.

One same-Codex correction is authorized for the two existing owning test files, capped at 480 seconds / 16 MiB with unchanged settings and containment. It will commit a finite literal baseline independently verified from accepted commit e818a3b639dfe903bdc16aff3674af98a5a08233, and compare every existing definition/decorator, ordered live source segment, and unchanged init/runner/workflow file without runtime Git-history reads. Expectations must not come from the proposed candidate.

All business fixtures, real isolated wheel execution, origin checks, product/core and guards remain unchanged. No skips, runtime baseline fetch, CI/dependency changes or automatic retry are allowed. Before any further full-suite or review qualification, the broker must test the delivered candidate in a depth-one checkout where the accepted base object is proven absent. The draft remains unaccepted.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: d88c7dc03d58046983a5f932f4f01c788973aeab
Findings: P0=0, P1=0, P2=0, P3=2 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Independent Claude review of the Codex-authored staged lineage producer APIs at exact head d88c7dc. The complete 110,988-byte diff and 371,698 bytes of owning source context were supplied and reviewed, covering trusted persistence, verified exit evidence, publication/readback effect ordering, bounded history, transport attribution and isolated package artifacts. No P0/P1/P2 findings; two nonblocking P3 notes below. Author exclusion is satisfied. Static review; tests and CI are tracked separately. Automatic consumer and maintained-runner activation remains deferred to #992.

Findings:

• [P3] observe_lineage_source could raise AttributeError instead of ProducerRefusal on a null repo field -- src/code_mower/lane_handoff.py:225
  Finding ID: claude:cab04768d9f2ac7de76b
  record.get("repo", "").lower() only falls back to "" when the key is missing; if the stored LocalWriter record has repo explicitly set to None, .lower() raises AttributeError rather than the intended ProducerRefusal/ContractError. In practice repo is always written as a validated Target.repo string by LocalWriter.register, so this is unreachable through the current call paths, but it's a latent gap in the fail-closed contract if the private record is ever malformed.
• [P3] lineage_handoff defaults sequence=1 with no guidance for multi-hop chains -- src/code_mower/lane_handoff.py:254
  Finding ID: claude:5f726be7986b85bff42a
  lineage_handoff(..., sequence=1) always defaults to sequence 1 for the produced handoff Episode. A later re-handoff onto an existing multi-episode chain would need an explicit sequence=len(previous_episodes)+1 override that no current caller in this PR supplies or documents. Not a bug in this PR's scope (no runner wires this yet, and Lineage stage 3: converge admission, status and label mutations atomically #992 owns activation), but worth flagging so the eventual broker caller doesn't silently create a sequence-1 episode on top of an existing chain.