Phase 2C: add controlled local teaching image generation

[xueyang-dev]

Change Summary

• Add one commit-pinned Comfy Org Stable Diffusion v1.5 FP16 EMA-only SafeTensors Model Package and one digest-pinned, seven-core-node ComfyUI teaching-illustration Workflow Pack.
• Add fail-closed model install, deep validation, repair, crash recovery, confirmation-bound uninstall, and physical separation from the managed Runtime and project data.
• Add joint generation_ready, controlled TeachingImageRequest compilation/execution, strict PNG verification, complete provenance, VerifiedImageArtifact, and atomic Asset Manifest registration.
• Extend Provider Hub with four truthful capability states and Runtime/model lifecycle actions; installing Runtime alone never claims image generation readiness.

Final Review Hardening

• Bind every execution to a caller-assigned canonical job UUID, client ID, complete fixed graph, sole output node, and successful completed history record.
• Use a unique request-bound SaveImage prefix so a prior prompt's cached output cannot be attributed to the current request.
• On failure or timeout, best-effort cancel only that UUID and only while the managed Runtime process/port identity is unchanged; late output has no Manifest publication path.
• Capture Runtime process identity and port in the compiled plan/provenance, then revalidate Runtime installation/process/listener, model installation, and workflow identities after PNG verification and before persistence.
• Re-read the bounded Manifest and recheck the optimistic project revision after the long provider execution and again immediately before publication; generation and model mutation remain serialized.
• Fail closed on malformed/linked Manifests and remove image/provenance files if Manifest registration fails.

Fixed Identities

• Model revision: 4fddeb7f9096623f1b77f4708feb96126a08a0cf
• Model size: 2,132,696,762 bytes
• Model SHA-256: e9476a13728cd75d8279f6ec8bad753a66a1957ca375a1464dc63b37db6e3916
• License: CreativeML Open RAIL-M, pinned text SHA-256 be351ebe7ac01bcdbb018639aadcfd38f136b7dc3f2a3d4d3a24db51d1b210ef
• Model manifest SHA-256: b86be7b3fc04afc839913e1d7a20aba19d4a0de401beeb08e970c829ef40c658
• Workflow Pack SHA-256: e25c17976054ad0122c943a22631640afd50fa52af960e839ce29cd168c1751e

Test Results

• npm test — 647 passed, 3 skipped; frontend TypeScript/Vite build and state contracts passed
• npm run test:e2e — 14 passed
• Ruff on the changed generation/test files plus critical syntax rules on touched shared files
• macOS arm64 real opt-in lifecycle — 1 passed in 301.86 s
  • Runtime install → model install/deep validation → first start/live readiness → real generation/PNG/provenance/Manifest verification → stop → model repair → second start/live readiness revalidation → stop → model uninstall → Runtime uninstall
  • Generated 512×384 RGB PNG, 341,808 bytes, SHA-256 834306448582d195bb96f96fa2513b30f560bcf995108b886c687fcc843c6de0
  • Verified artifact img-52f57fda24abf00f3e08b9bb; provenance SHA-256 16b13b8924c764850ca62387b922b5cdc94503dc60d166383ccb3438915425f6
  • Model and Runtime removed; project image preserved; post-repair generation_ready=true was revalidated before cleanup

Impact Checklist

• Changes artifact schema (new Phase 2C provenance fields; verified_image_artifact remains optional on AssetFile)
• Changes quality gate
• Changes runtime HTML export
• Changes editable PPTX export
• Changes Agent Handoff rules
• Frontend-visible change

Notes

• Final review completed; merge authorized
• Generated images, model bytes, caches, Runtime trees, and validation reports are Git-ignored and are not included in this PR.
• The real artifact remains pending_review: it is original and text-free, but SD 1.5 did not reliably express the requested wave/greeting, exact person count, or classroom environment. Prompt adherence and classroom-semantic quality remain explicit teacher-review risks.
• CreativeML Open RAIL-M includes use restrictions and redistribution/notice obligations; release counsel review remains required.
• Deliberately out of scope: marketplaces, arbitrary model URLs/workflow JSON, custom nodes, LoRA/ControlNet/external VAE, editing/batches/character consistency, lesson auto-generation, cloud fallback, Windows/Linux installation, and video.