feat: execute SDL participant inject sequence

[Brad-Edwards]

Summary

Execute participant directed injects from compiled RAES SDL during the normal lab start lifecycle, using the operator's authenticated Claude CLI and retaining governed control, crossing, timing, and evidence records.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #601

ADR Impact

• ADR-021
• ADR-052 (amended)

Changes

• replace the study specific readiness path with a generic SDL participant delivery adapter
• advance authored logical time and record proposal plus external direction controls through the RAES control plane
• use role scoped MCP profiles, separate red and blue Claude sessions, and the operator's existing CLI authentication
• retain four content addressed delivery records and document the successful TechVault qualification run
• declare exact participant ingress support and preserve crossing history when APTL adopts runtime snapshots
• preserve image free host publications during declared network reconciliation
• split participant planning, crossing, transport, evidence, execution, and capability code into focused quality-gated modules
• reconcile the rename and scenario pack documentation inventories with the final tree
• use a user-owned executable fixture in cross-platform participant delivery tests

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Local targeted gate: 869 passed before the CI repairs; focused repair gates passed 269 tests, 13 inventory regression tests, and 433 participant/runtime/deployment/evaluator regressions. Stricter complexity checks and staged pre-commit hooks passed. Live qualification run run_20260925T153251Z completed four SDL-authored deliveries and reached Lab is ready; its later stop removed the lab but reported transcript finalization failure, so the artifact remains explicitly unsealed.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: Issue Track the APTL participant demonstration #601 ← src/aptl/backends/raes_participant_delivery.py, Issue Track the APTL participant demonstration #601 ← src/aptl/core/lab.py, Issue Track the APTL participant demonstration #601 ← src/aptl/backends/raes_manifest.py
• TESTS: Issue Track the APTL participant demonstration #601 ← tests/test_raes_participant_delivery.py, Issue Track the APTL participant demonstration #601 ← tests/test_raes_backend.py, Issue Track the APTL participant demonstration #601 ← tests/test_lab.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud