fix: close exact Bun apply integrity gaps

[andrei-hasna]

PR #89 was merged at a5e0bf3 while the latest current-head review was Xenon's attributed NO_GO. The remediation commit was then pushed to the former head branch and is not contained in main.

This follow-up lands only the three named fixes from that review:

• remove the obsolete public exact-Bun target executor commands that bypassed mutation approval;
• live-revalidate caller-supplied installed state before an exact apply or zero-step COMMITTED result;
• run SDK imports from the target Bun global install root.

Verification:

• bun run typecheck — exit 0.
• bun run test — exit 0; 606 pass, 0 fail, 3250 expect() calls across 66 files.
• staged gitleaks git --staged --redact --no-banner . — exit 0; no leaks found.

Remediation commit: fbb5831
Original review: #89 (comment)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #90 @ d463190 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

Focused re-review of the three P1 defects named on #89 and their direct regressions. The remediation tree is unchanged from the tested fix commit, and the candidate is rebased onto current main a5e0bf3.

Named defects rechecked:

• Public approval bypass: machines apps --help exits 0 and exposes neither exact-bun-transaction nor exact-bun-status; the controller/bootstrap path remains covered and contains no command dependency.
• Installed-state integrity: exact apply now performs a full live target status read, compares the live replan digest with the approved installed-state replan, rejects drift with installed_state_stale, and does not load source on rejection. The passing zero-step path contacts the target once before reporting COMMITTED.
• SDK status resolution: the negative control exits 88 outside the global root, while executeExactBunTargetStatus passes both probes when it supplies the global install root as cwd.

Exact-head gates and controls:

• bun run typecheck — exit 0; tsc --noEmit, 0 diagnostics.
• bun run test — exit 0; 606 pass, 0 fail, 3250 expect() calls, 606 tests across 66 files.
• Staged gitleaks git --staged --redact --no-banner . before the original remediation commit — exit 0; no leaks found.
• git merge-tree --write-tree a5e0bf39632261ff891e2116b8a710428ff857dd d4631904267cdd9b404dae9aa5609d5b10cab1e3 — exit 0.
• git diff --quiet d4631904267cdd9b404dae9aa5609d5b10cab1e3 <merge-tree> — exit 0; the reviewed head tree is exactly what will land.

Blocking P0/P1 findings: none. The prior P2 strict-schema compatibility follow-up remains non-blocking and is not relitigated in this focused pass.