Retire legacy Todo events and simplify experimental supervisor logging

[huangruiteng]

The experimental Todo events.jsonl route duplicated Todo state projection and completion, while supervisor proposal/receipt logging was its remaining independent caller. This PR retires the Todo route and gives the default-off supervisor a small, private log under its existing owner.

• Delete Todo event replay, Markdown overlays/backfill, event completion/writeback and the unused event-store migration bridge. Remove their dead output fields, canary entries and fixtures; keep the downstream CLI journey on supported Todo sources.
• Refuse nonempty legacy event sources (including all three aliases) before legacy reads, writes, completion validation or shadow qualification. Preserve their bytes. Promoted Goals continue using the selected provider, including with stale legacy files present.
• Simplify supervisor logging to single-record TS append admission and Python durable IO. Proposal/receipt validation and publication share one lock; preview uses the same semantic identity check without publishing/syncing. Conflicting retries and competing executed receipts reject; uncertain publication can recover the original record.
• Reconcile both RFCs: the retired source needs no replacement event-capture PR. Whole-Goal migration/rollback, external-effect fencing, default onboarding and D2 qualification keep their existing acceptance.

The provider authority ledger remains intact: events, projection and original receipts commit atomically, and ordered transaction history remains readable. This retires the legacy Todo event-sourcing implementation, not the append-only ledger abstraction. Current retained state recovery uses checkpoints and exact deltas; it does not claim that domain events alone reconstruct every Goal state.

Compatibility: loopx.event_sourced_state and its experimental Todo protocol are removed. Preserve and inspect/export any old nonempty Todo event file with a compatible older release before deliberately removing it from the active source location. The experimental supervisor now uses supervisor_log_event_v0; older log formats require manual archival before a fresh log, and are refused without rewriting. A persisted executed receipt does not guarantee exactly-once host effects across the effect-to-receipt crash window.

Validation on the replacement implementation: 107 critical Python tests, 50 source/governance tests, 30 outbox/status tests; two supervisor CLI smokes; integrated status/quota/completion/review-packet, graph and catalog smokes; source-refusal ladder; two lock mutants killed by assertions after passing controls; 23 final TS/SQLite owner and capacity checks; 293 real PostgreSQL integration tests with zero skips on an isolated server; TypeScript typecheck, declared mypy scope, Ruff, registry I/O census and public-boundary audit. Read-only current-CLI checks of two promoted File Goals preserved their display bytes. Broader exploratory runs exposed obsolete event fixtures, which were replaced and rechecked; these counts do not claim a complete CI run or full D2 capacity/soak qualification. Final premerge passed all 19 selected checks with zero failures. The broader Python set finished with 416 passes and four environment skips; its single obsolete ladder assertion was corrected and the exact pytest case passed on rerun. Independent review caught broken Book links; root docs and both Books now pass strict builds with canonical loopx-project URLs. Installed CI also exposed a baseline packaging omission for runtime/receipt_log_snapshot.ts; the package-data declaration is corrected. Rebuilt wheel and sdist pass the full installed-authority E2E, and installed Python 3.11 workflow-skill inspect/install/uninstall pass. Independent review and remote CI must requalify the updated head.

Refs #4574. No provider default or production Goal migration is performed by this PR.

[huangruiteng]

Replacement implementation validated at a91cc0962411630acd6a4cd15aee36ed446682c6.

The Todo event source, replay/overlay/backfill and completion branch are removed. The experimental supervisor has a separate single-record log; old experimental formats fail without rewriting. Nonempty legacy Todo sources refuse reads/writes/validation and shadow qualification, while promoted provider reads remain independent of stale legacy files.

Final premerge: 19/19 selected checks passed, zero failures. Exact-scope change-quality receipt is valid. Focused source/governance, completion, mutation, outbox/status and supervisor checks passed; real PostgreSQL integration passed 293 tests with zero skips; SQLite capacity rehearsal and two promoted File readbacks passed. Both writer-lock mutants were killed by assertions after passing controls. The broader Python run had 416 passes, four environment skips and one obsolete ladder assertion; that assertion was corrected and its exact pytest case passed on rerun. The TS sweep exposed retired event characterization plus a capacity rehearsal failure; final targeted rechecks passed all 23 cases. These results do not claim full D2/soak qualification or completed remote CI.

Future-facing simplification: remove the duplicate Todo authority rather than extending its capture; reuse existing durable file IO and typed append admission for the experimental supervisor. No frontend companion change is required: CLI/source contracts change here, and current status/manager consumers use the existing canonical-first Todo read and error path. External host effect-to-receipt fencing remains separate.

Independent review requested from the designated peer on this exact head. No self-merge performed.

[huangruiteng]

Review fixes are pushed at e657c09c8:

• Correct the broken cross-site retirement links and use loopx-project/loopx throughout the six documentation files touched by this fix. Root documentation and both language editions of the Developer Book pass MkDocs strict builds.
• Reproduce installed-runtime startup failure: Node could not resolve control_plane/runtime/receipt_log_snapshot.ts, introduced on the baseline but omitted from Python package data. Add the existing runtime directory to the TypeScript package-data declarations; no runtime semantics change.
• Rebuilt wheel and sdist each pass all five required installed-authority E2E stages. The rebuilt wheel also passes Python 3.11 workflow-skill inspect, install/readback and uninstall outside the checkout.
• Clarify the architecture boundary in the PR description: the provider transaction ledger remains; retiring legacy Todo event replay does not delete atomic event/projection/receipt commits or ordered history. Checkpoint/delta state recovery is not a claim of complete domain-event-only replay.

Exact committed-scope change-quality verification is valid. Independent review and remote CI must qualify this updated head; this is not a merge approval.