feat: attest After Effects CEP runtime identity and bounded bootstrap

[loonghao]

Summary

After Effects CEP readiness needs typed evidence that the connected session belongs to the exact selected broker, signed After Effects process, profile, and installed CEP bridge. Current adobepy 0.6.2 cannot provide that complete attestation or a bounded launch/bootstrap-to-verify continuation.

Required contract

• expose secret-free broker PID, process-start identity, executable path, version, and instance ID;
• expose After Effects PID, process-start identity, signed executable path, product version, instance/profile IDs, target, CEP bridge version, connection epoch, installed plugin root, and loaded module origin;
• provide a bounded host launch/bootstrap action followed by an exact machine-executable verify continuation;
• return stable structured failures for missing, stale, ambiguous, foreign, or mismatched identity.

Acceptance

• adapters can cross-check broker and host values against independent OS observations and an install receipt;
• stale PID reuse, wrong AfterFX product/profile, foreign target, connection-epoch mismatch, and CEP module shadowing fail closed;
• fields and outputs are bounded and never expose tokens, credentials, local diagnostics, or raw stderr;
• no arbitrary command execution, arbitrary JSX/ExtendScript, UI automation fallback, or broad execution surface is introduced.

This blocks exact-instance directly_usable: true for the After Effects Install SOP lifecycle. Compile, package, or capability evidence alone is not live host readiness.

Refs dcc-mcp/dcc-mcp-aftereffects#13
Refs dcc-mcp/dcc-mcp-core#2252