feat: add deployment control-plane contracts

[andrei-hasna]

Summary

• add 13 strict versioned deployment control-plane contracts from ProductProjection through LaunchEvidence
• add canonical digests, linked-record validation, deterministic fixtures, generated JSON Schema/checksum artifacts, public exports, and packed-consumer coverage
• register only the deployment app canonical hasna-deploy operator binary
• align oversized packed no-cloud member handling with the existing source-tree bound
• prepare @hasna/contracts@0.10.3

Verification

• full release matrix: 1341 pass, 7 skip, 0 fail, 13743 expectations
• deployment generated artifacts: 16 files current
• package-security + service-contract metadata recheck: 52 pass, 0 fail, 153 expectations
• typecheck, conformance, build, dist smoke, isolated packed consumer, pack dry-run, and artifact scan: pass
• pack: hasna-contracts-0.10.3.tgz, 223 files, 19.30MB unpacked
• artifact scan: 223 members scanned, 0 excluded, 0 unreadable
• staged secret scan and diff check: rc=0

Scope

Todos task: 2e56818b-c6d2-4a18-8534-09634c7e3a9b (OPE85-00070). No live AWS or deployment mutation is included.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #93 @ 75c4b44 — lens: correctness+security+gates, reviewer Trebius (1 of 1)

Reviewed the full diff of all 36 changed files against freshly fetched origin/main at 80e65e3, plus surrounding production code, callers, generation scripts, tests, package exports, and generated deployment artifacts.

Declared gates and setup:

• bun install — exit 0; setup only, 23 packages installed.
• bun run typecheck — exit 0; tsc --noEmit emitted no pass/fail count.
• bun run test — exit 0; 1341 pass, 7 skip, 0 fail, 1348 tests across 60 files.

Additional verification:

• git diff --check origin/main...HEAD — exit 0.
• bun scripts/generate-deployment-contract.ts --check — exit 0; 16 generated files current.
• Generated-artifact verification — 15/15 manifest checksums, 13/13 record digests, 330/330 internal JSON Schema references, and 13/13 fixtures passed the independent Draft-07 subset check.
• bun pm pack --dry-run --ignore-scripts — exit 0; 124 files, including all 16 generated deployment artifacts.

Blocking P0/P1 findings:

1. P1 — A denied approval can authorize a succeeded and launched deployment (src/deployment.ts:827-873, src/deployment.ts:904-956, src/deployment.ts:1027-1065, src/deployment.ts:1367-1389). DeploymentApprovalDecisionSchema accepts decision.status: denied, and neither the attempt/receipt schemas nor validateDeploymentContractSet require referenced decisions to be allowed. A valid fixture was changed to a denied decision, all downstream records were re-digested, and the probe returned exit 0 with approvalStatus:"denied", attemptState:"succeeded", receiptOutcome:"succeeded", and validation:{"success":true,"issues":[]}. This violates the deployment authorization invariant on the exported validation path.

2. P1 — Cross-record validation permits receipt lineage to be assigned to the wrong product (src/deployment.ts:1379-1394). The receipt pass validates request, plan, attempt, approvals, and provider receipts, but does not resolve its product, intent, artifact, attestations, or environment, and does not enforce coherence with the referenced request/plan chain. A second valid product was substituted only into the receipt, the receipt and launch record were re-digested, and validation returned exit 0 with requestProduct:"product-example-app", receiptProduct:"product-alternate", and success:true. Deployment and rollback evidence can therefore be attributed to an unrelated product while the required cross-record gate passes.

3. P1 — Packed no-cloud scans fail open on source-shaped archive members above 5 MiB (src/no-cloud.ts:1055-1087, src/no-cloud.ts:1116-1218, tests/no-cloud-edge.test.ts:1459-1473). The new ENOBUFS/maxBuffer catch silently skips the member and records no unreadable finding. A tarball whose only JavaScript member exceeded 5 MiB and contained the forbidden @hasna/cloud runtime reference returned exit 0 with {"verdict":"passed","status":"succeeded","findings":0,"sourceRuntime":"succeeded"}. The published-package safety gate can therefore certify an unscanned runtime artifact.

Required remedy before merge:

• Require resolved deployment approvals to be allowed and bind their scope, attempt bounds, environment, plan, and immutable input digests to the executable chain.
• Resolve every receipt/launch reference and enforce one coherent request → plan → attempt → receipt → launch lineage, with cross-product/environment substitution tests.
• Fail closed on unreadable or oversized source-shaped packed members, or scan them completely with a streaming implementation; add a negative control where the forbidden occurrence exists only in the oversized member.

Non-blocking follow-ups: none material. The generated artifacts and package inclusion checks were internally consistent.