M4 epic: Desired resource schema and composition

[Andreas-Froyland]

Tracking issue. Dependency and status checklists only — implementation stays in narrow linked issues.

Outcome

Versioned desired resources exist for machines, profiles, projects, tool requirements, skill presets, recipes/actions, Lab templates, and policy bindings, with deterministic composition and provenance.

Supersedes

Replaces the machine manifest, role inheritance, skill pack, capability metadata, project, and test-profile schema portions of #2. The declarative intent of #2 is kept; its informal YAML schema is replaced by a versioned, machine-checkable one.

Depends on

• FM-005 — desired-resource envelope and schema workflow (M0)
• FM-004 — shared IDs, time, errors, sensitive-value primitives (M0)
• M2 machine model

Scope checklist

• apiVersion/kind resource definitions for machine, profile, project, tool requirement, skill preset, recipe/action, Lab template, policy binding
• Deterministic composition order and provenance for every resolved field
• Legacy role/pack fixtures migrated without preserving accidental schema constraints
• Published JSON Schemas generated and checked in CI

Constrained by

• docs/PLAN.md — M4; docs/architecture/desired-state.md
• ADR-0004: desired resources carry no observed, status, or secret values

Non-goals

• Reconciliation, drift, or apply behavior (separate epics)
• A generic configuration-management language