feat: compile deterministic test bootstrap plans

[thelostorbital]

Summary

• compile a deterministic, I/O-free WF-TEST-01 bootstrap plan from validated harness configuration, immutable GCP preflight observations, explicit policy hashes, and integer-micro-USD pricing evidence
• seal exact desired resources, run caps, execution identities, dependencies, verification, retry/timeout, compensation, rollback, and the D-158 retention-lock point of no return
• provide strict canonical serialization and parsing with complete cross-binding validation and detached immutable accessors

Safety properties

• no provider calls, process execution, durable writes, commands, argv, credentials, or mutation adapters
• fail closed on stale or mismatched observations, CIDR overlap, unavailable APIs, public MongoDB ingress, target collisions, unsupported machine evidence, and cap ambiguity
• preserve the closed cleanup capability set and exclude permanent harness/control resources from disposable cleanup
• keep TEST-I, TEST-D, and unrelated mutations unrepresentable before the T8 transition

Verification

• GOWORK=off go mod tidy -diff
• GOWORK=off go run ./internal/archcheck
• GOWORK=off go test ./...
• GOWORK=off go test -race ./...
• QLTY_TELEMETRY=off qlty check --all --no-fix --level=low --fail-level=low
• bash scripts/test-architecture-rules.sh
• bash scripts/check-go-licenses.sh
• git diff --check

No GCP command or mutation was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T02:47:36.509738Z	cd38a9e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a099afaf1b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

ctrldb/internal/config/harness.go

Lines 217 to 218 in 5b1567d

	controlBucket: wire.Spec.Control.StateBucket, auditBucket: wire.Spec.Control.AuditBucket,
	namePrefix: wire.Spec.TestIsolation.NamePrefix, labels: cloneStringMap(wire.Spec.TestIsolation.Labels),

Reject identical control and audit bucket names

A structurally valid manifest can set stateBucket and auditBucket to the same name, and this projection accepts both without a distinctness check. The compiler then creates two logical resources with the same provider identity: K1 locks that bucket for 365 days, after which K2 attempts to establish the incompatible versioned/soft-delete control-bucket state, leaving an irreversible partial bootstrap that cannot converge as planned. Reject equality before compiling any mutation steps.

AGENTS.md reference: AGENTS.md:L24-L27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd38a9e681

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".