Qualify ROM library copy workflow

[whatobiplays]

What changed

• Added production-generated feature.copy_roms qualification coverage with strict source-bound validation and deterministic fixtures.
• Added a lower-level executor regression for directory-style sync.
• Corrected the shared directory-copy primitive so sync removes destination-only files before copying source content.
• Documented the automated qualification contract and current evidence boundary.

Why

Directory-style sync was incorrectly preserving destination-only files. The authored contract defines sync as a mirror of its source.

Scope

The correction is limited to the shared directory-style copy path. Single-file sync, merge, replace, and unrelated host/device/app-private/path-list branches retain their existing behavior.

Validation

• Authored recipe validation passed.
• Rust formatting, default tests (829 passed, 17 ignored), real-execution tests (829 passed, 17 ignored), no-default and real-execution checks, and all-target/all-feature clippy passed.
• Focused ROM qualification tests: 11 passed.
• Phase 6D.6 evidence contract validation passed with the existing physical-device and UI-smoke evidence gaps explicitly preserved.
• Phase 6D.6 regression tests: 47 passed.

This remains an automated qualification change; it does not claim physical-device or full end-to-end qualification.

---

Summary by cubic

Qualifies ROM-library copy, RetroArch first-launch, and XaniteOG install workflows, and corrects directory-style sync to mirror its source. This aligns behavior with the authored contract and adds automated evidence for three production-authored workflows.

• Adds automated, production-generated qualification for feature.copy_roms: verifies planning, review, and deterministic merge/replace/directory-style sync execution, with a failure-path test; proves sync removes destination-only files.

• Extends app.retroarch.provision qualification: asserts both first-launch sequences (bootstrap 1500 ms, permissions 5000 ms) and adds a deterministic bootstrap force-stop failure that blocks dependent work without mutating the plan.

• Adds automated qualification for app.xaniteog.install: binds a strict contract, validates required .apk input and package_installed skip, executes the unchanged plan through sandbox adapters, skips on repeated run, and truthfully fails on a deterministic install error.

• Fixes the sandbox fake-device directory-copy path so directory-style sync removes the target directory before copy; updates the focused executor regression.

• Adds docs/product-contract.json and docs/product/recipe-qualification-xaniteog.md; updates roadmap, RetroArch doc, and context to record these qualifications.

• Migration

  • If you relied on sync preserving destination-only files, switch to merge or relocate those files before running sync. No API changes required.

^{Written for commit bd12b12. Summary will update on new commits.}