feat(v0.6): persist W41 fleet state and capability evidence

[ammarheidari]

Authority

Continuation of governed W41 in #150 under tracker #146. Planning was admitted through #147. The first W41 foundation was governed-merged through #151 into protected main=fbe9baea97a65261bb0ff87a06df90d2e8f5a07d.

This PR remains draft/in-progress. W41 is not complete and W42-W45/W47 remain dependency-blocked until the full W41 exit gate is satisfied.

Current exact head

c6ce70a2049c843c476f8cc780af4e79db9b3d44, based on protected main=fbe9baea97a65261bb0ff87a06df90d2e8f5a07d.

Implemented in this continuation

Pinned-client capability evidence

Against the repository-pinned Confluent.Kafka 2.15.1 surface:

• compile-probe ACL describe/create/delete;
• compile-probe SCRAM describe/alter;
• compile-probe config describe/incremental-alter;
• compile-probe preferred-election support;
• retain explicit fail-closed evidence that the pinned .NET surface does not expose client-quota or partition-reassignment APIs used by admitted future work;
• no CLI/REST/reflection/provider tunnel and no provider I/O in these probes.

Durable subordinate fleet state

• add IFleetMutationStateStore under the existing mutation-operation authority; it is not a parallel executor or approval aggregate;
• add additive SQLite/PostgreSQL persistence for versioned fleet progress and sticky conflict obligations;
• parent foreign keys with ON DELETE RESTRICT, explicit schema-version refusal, optimistic CAS fencing and immutable obligation identity checks;
• preserve blocking obligations independently of worker lease state; there is no delete/clear API;
• persist observation accounting across store/process reconstruction;
• retain quarantine blocking and supersession no-redispatch/predecessor-binding tombstones;
• reject orphan subordinate state when no parent mutation operation exists;
• extend v05-persistence to run W41 SQLite and real PostgreSQL persistence/CAS coverage.

No provider mutation route, provider handler, generic execution surface or raw record/credential persistence is introduced.

Deterministic CI finding and disposition

At head f5ffd8df1bece31bb0fdff12d78fb76a5b0481e7, v05-persistence #35986870744 failed 1/56 tests. Job logs showed the sole failure was PostgreSQL concurrent DDL contention on CREATE TABLE IF NOT EXISTS kafdeck_schema_info (23505, pg_type_typname_nsp_index) because unrelated PostgreSQL facts initialized the same public schema in parallel. The product assertions, SQLite W41 tests and remaining 55 tests passed.

The test was corrected—not rerun unchanged—by isolating the W41 PostgreSQL exercise in a unique real PostgreSQL schema. On current exact head c6ce70a..., v05-persistence #35987230153 is success.

Current exact-head CI

• quality-gate #35987230182 — success
• dependency-review #35987230223 — success
• codeql #35987230130 — success
• v03-benchmark #35987230201 — success
• v04-benchmark #35987230186 — success
• v05-persistence #35987230153 — success
• release-supply-chain #35987230203 — success

These checks are evidence for this head only and will be invalidated by the next source-head change.

Remaining W41 work before final admission

• wire durable fleet conflict obligations into the shared v0.5 resource-claim/pre-dispatch conflict path so an expired worker lease cannot bypass an outstanding effect;
• add mixed-version refusal/recovery safeguards for executors that cannot understand v0.6 subordinate state;
• implement/test the common existing-Connect replication activation bypass-guard foundation while keeping managed MM2 start/resume unavailable;
• reconcile capability evidence and all W41 exit tests on the final latest-main head;
• then mark ready for review, obtain substantive review + fresh exact-head CODEOWNER approval from akhiabanchian, verify zero unresolved threads/ruleset/CI and use guarded merge.

Refs #150.