eval: guard adopt-only migration lifecycle

[schickling-assistant]

Paired with compoundingtech/evals#52, merged runtime PR compoundingtech/st2#99, and closed runtime issue compoundingtech/st2#98.

Why

Publishing a declaration for an already-live task currently also grants authority to create or replace that task. A zero-interruption migration needs a fail-closed lifecycle fence that can adopt an existing generation without cold-launching an absent or later-dead one.

What

Adds one model-free cell with an eval-owned PTY root that proves:

• a live adopt-only task is adopted without changing its PID or process generation;
• absent and later-dead adopt-only tasks are reported held without launch or reap;
• an explicit transition to lifecycle "service" authorizes replacement;
• an ordinary absent task still launches as a mutation-valid positive control; and
• cleanup leaves no synthetic PTY live.

Pre-reap immutable generation receipts remain the distinct follow-up in compoundingtech/st2#40; this PR intentionally does not freeze that path or schema.

Current proof

GREEN: 7/7 focused gates against merged st2 main c6846f6239329f0803142afc06c15a07b93937c1 (binary SHA-256 2bba8d58…).

SCORE: 7 PASS / 0 FAIL / 7 gating judges
VERDICT: PASS

Restacked on exact evals main 0070ba465901998e325367661a14f6cb577b8009. The complete pinned free preflight also passes against st2 9887b28 (binary SHA-256 d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d):

• 167 shell files pass bash -n
• 77 KDL files validated
• 47 maintained catalog cells and 10 nested catalogs checked
• generated catalog current
• no-PII clean
• VRS living-spec gates green
• git diff --check clean

Historical pre-implementation proof

Before st2 #99, exact st2 main f96f925 produced the expected RED:

SCORE: 4 PASS / 3 FAIL / 7 gating judges
VERDICT: FAIL

The live-adoption, ordinary-launch control, run-step, and cleanup gates passed. The absent hold, exited hold, and explicitly-authorized replacement sequence failed because that pre-implementation runtime treated lifecycle as inert.

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	evals-adopt-only-migration/schickling/adopt-only-migration-eval
machine	dev3
tooling_profile	dotfiles@0fb7e03