feat(workbench): bring up the LoopX Stage 2A stack from one command

[wchwawa]

Related Issue

Relates to #511 and to the LoopX shared-goal-authority qualification that consumed #514 (loopx-project/loopx#4774). No dedicated issue: this is a test-harness addition whose scope is defined by the LoopX ladder rows it serves; the approving review on loopx#4774 recorded that the LoopX maintainer had no live NoKV owner or workbench to rerun the write-producing Stage 2A probe, and this PR removes that gap.

Summary

• scripts/workbench/loopx_stage2a_stack.py up brings up, from one command, the single-node stack LoopX's s0.nokv_live_matrix and s2a.nokv_live_qualification rows expect: an isolated etcd member, the digest-pinned RustFS container from start_rustfs.sh (or --object-store moto without Docker), one provisioned owner (--metadata-create, provision / serve argv shape of live_workbench.py), one workbench created through the SDK (asserting exactly one incarnation), and the two files those rows read: nokv-client.json in the exact key shape LoopX's nokv_jsonl_helper.py admits and live.env with the thirteen NOKV_* / LOOPX_NOKV_AUTHORITY_* variables. Both are written 0600; stdout carries only digests.
• Admission is fail-closed: the wheel under --python must report the same version as nokv --version and export WorkspaceIncarnationMismatch (LoopX pins a fenced 0.11.1 SDK); a non-empty stack directory, a missing binary, a missing etcd, or a generated leaf that would trip LoopX's ladder privacy scan all refuse before anything starts, and a failure after start stops what it started and records the exit codes in stack.json.
• plan prints the redacted plan without starting anything; status reports process liveness (exit 1 when anything is gone); down [--purge] stops the owner, etcd, moto or the RustFS container.
• loopx_stage2a_stack_test.py freezes the command shapes, the LoopX key contracts, secret redaction, the privacy-collision check and the fail-closed plan/down/status paths without starting a process; the workbench-contract CI job compiles and runs it. docs/development/loopx-stage2a-stack.md documents prerequisites, outputs, the LoopX commands and what the stack does not prove.

Validation

Check	Result
python3 -m py_compile scripts/workbench/loopx_stage2a_stack.py; python3 scripts/workbench/loopx_stage2a_stack_test.py (17 tests); bash -n scripts/workbench/start_rustfs.sh	passed (the exact workbench-contract job lines)
Cold start, RustFS, prebuilt 0.11.1 binary: up in 5.8 s; status ready; down stops both processes and the container, status then exits 1	passed
Cold start, --object-store moto: up in 4.0 s; LoopX s2a.nokv_live_qualification pass (15 checks); down --purge leaves nothing	passed
Cold start with --build from this checkout (590d3a4bdc, the v0.11.1 tag): binary built with cargo build --release --locked -p nokv --bin nokv, up in 6.8 s	passed
LoopX complete 23-row ladder against the --build stack, LoopX main 4bed6ed3d clean tree, released nokv==0.11.1 wheel (checksum verified), Node 22.22.3: 22 pass, s2b.postgresql_conformance_live unverified (no PostgreSQL), s2c2.sustained_parity_soak pending as declared, privacy scan 0 violations; s2a reports 15 checks including stale_incarnation_fence_rejected and stale_incarnation_fence_left_generation_unchanged, final generation 3	passed
Negative pairing on the same stack with the released nokv==0.11.0 wheel: s0 pass, s2a fails typed (nokv_transport_protocol_failed, helper refuses the wheel at admission; no publication reached the owner)	passed (expected refusal)
Wrong --python (system interpreter without nokv), non-empty stack dir, unknown stack.json schema	refused with typed messages, exit 2

Two defects surfaced during validation and are fixed in this head: require_executable must keep a venv's bin/python symlink instead of resolving it (the resolved base interpreter has no nokv), and the privacy check must not list routing kinds as ladder vocabulary (the configuration's own etcd leaf tripped it). One LoopX-side condition was observed and is recorded in the LoopX ledger entry, not here: under macOS's symlinked TMPDIR the ladder's s2c2 rows fail because LoopX digests the runtime root with realpathSync on the TypeScript side and os.path.abspath on the Python side; a symlink-free TMPDIR passes.

Scope

• This PR changes one logical boundary only.
• No unrelated refactor, benchmark, metadata model, Holt layout, object-store, agent interface, or docs change is mixed in.
• The linked issue describes the user-visible problem, design decision, or maintenance task this PR resolves.
• Any breaking change is intentional and documented. (None.)
• No compatibility shim, deprecated alias, or forwarding wrapper was added without a removal condition.

Change Size And Review

• I checked GitHub's additions plus deletions for this pull request.
• If the total is more than 5,000 lines, one core maintainer other than the current-head pusher approved the exact current head commit. (Not applicable: about 1,240 lines.)
• This change is still small enough for a focused review; approval count is not being used to justify mixed package or lifecycle boundaries.

Code Contract (Code Changes Only)

• Not applicable to the Rust packages; this adds a Python test harness under scripts/workbench/, its unit test, a development doc, one README bullet, one docs index link and two lines in the workbench-contract CI job.