Make delivery lifecycle transitions authoritative

[bigboateng]

Summary

Boatstack could correctly enter a recovery state while still computing the next command from an older, narrower view of delivery state. Delivery mode, slice position, plan lock, observations, workspace identity, and approval evidence were resolved independently. In the amendment path, that split authority produced a deadlock: delivery required planning, bootstrap rejected the existing managed feature, and next-status continued to project the active BUILD slice.

This rewrites lifecycle resolution around one composite snapshot and one registered transition system. Recovery mode now has authority over the underlying slice, and every planning, approval, and activation command is derived from and bound to the same lifecycle evidence.

What the rewrite changes

• Introduces a canonical lifecycle snapshot covering delivery mode, resume stage, slice position, plan lock, observation, repository/worktree/branch identity, configuration, and approval state.
• Makes amendment and invalid-plan recovery explicit registered transitions rather than exceptions spread across bootstrap, status, planning, and safety code.
• Gives active amendments a complete managed path: rewrite the plan, approve the new plan, reactivate it, then resume delivery.
• Binds prescriptions and receipts to the current lifecycle fingerprint, source plan, prior lock, and observation so drift is rejected before mutation.
• Routes generated Cursor, Claude, Codex, and Gemini guidance through the same lifecycle resolver used by the CLI.
• Renders each planning prescription in one complete shell grammar: a literal POSIX heredoc for POSIX shells or the existing UTF-8 PowerShell here-string for Windows.
• Adds static completeness checks for every durable delivery field and every lifecycle reader, writer, renderer, status path, CLI/SDK entry point, and host hook.

Problems this solves

• An active delivery can no longer become permanently stuck after a requirement amendment.
• Slice status can no longer override a stronger recovery mode and route the operator back toward an illegal stage.
• Invalid active plans can be repaired through the same supervised path instead of requiring an unsafe bypass.
• Stale planning commands, observations, plan locks, and approvals cannot be replayed after lifecycle drift.
• Host adapters cannot silently disagree with native lifecycle resolution.
• Windows detached-runtime commands no longer mix PowerShell invocation with POSIX transport syntax and get falsely rejected as controller-state tampering.
• Adding an unclassified state field or lifecycle entry point now fails conformance checks instead of creating another hidden split-authority path.

The rewrite preserves raw managed-path write denial, destructive-operation controls, publication controls, workspace binding, plan-lock validation, and human approval requirements.

Test plan

• cd boatstack && go test ./... -count=1
• cd boatstack && go vet ./...
• cd boatstack && go build ./...
• python3 -m unittest discover -s .github/tests -p "test_*.py"
• python3 .github/scripts/test_ci_shard.py
• python3 .github/scripts/release_notes.py validate --repo .
• git diff --check