fix(runtime): align the served control-plane profile

[Brad-Edwards]

Summary

Bring the reference HTTP control-plane adapter fully under profile P2 (ADR-104 §2/§7; FM3 invariants 9-10) on top of the CP-1..CP-7 core. Provider-error redaction is centralized so no exception strings, paths, or class names reach clients; the obsolete post-hoc receipt-audit route seam is removed so the core transaction is the sole terminal-audit writer; side-effect-free API-408 participant projections are served on the non-contending read path carrying their observed snapshot revision, while RUN-319 governed egress stays on the one mutation authority and commits its crossing evidence before disclosure; and both global exception handlers now apply the best-effort audit rule so a failed secondary audit never replaces the stable 4xx/5xx envelope.

Requirement UIDs

• API-404

Related Issues

Refs #1188

ADR Impact

• ADR-104

Changes

• Redaction (acceptance criterion 5): _conflict_detail maps SnapshotRevisionConflict to its stable label and every other conflict to the coarse 'operation conflict' envelope, never str(exc); the participant execution-state 404 and invalid-terminal-reason 400 details are now static; the rejection-audit failure logs a stable label instead of a traceback.
• Terminal audit (criterion 4): removed the no-op _record_operation_receipt_audit seam and its call sites across the operation, participant, and workflow routes so the core transaction is the only terminal-audit writer.
• Reads (criterion 6): API-408 participant status/history/context projections run on the non-contending run() path and carry their observed X-RAES-Snapshot-Revision when no crossing-policy resolver governs the participant; governed RUN-319 egress remains a read-shaped mutation on the one mutation authority.
• Failure boundary (pre-push review finding core-F1): both global exception handlers record their redacted denial audit through one bounded best-effort helper with a stable reason, so a failed secondary audit cannot replace the stable 500/422 envelope.
• Verification: extended the fix(runtime): harden HTTP API admission and offload #1133 admission suite with cross-principal idempotency scoping, terminal-audit atomicity, multi-worker admission, redaction (secret/exception-string/traceback scans), audit-failure resilience, and API-408 read-contention plus governed-egress tests.
• Reconciled the source-bound research evidence bundles (specification-coverage v32, formal-retest v32) for the runtime implementation-digest change, and corrected a stale current-release formal baseline pin left by fix(runtime): make idempotency claims atomic and scoped #1321 to its true value so the formal semantic-validation gate is green.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression

Ran the control-plane HTTP suite (test_runtime_control_plane_api.py, 82 passed), the governed-crossing/core/reference-processor suites (112 passed), the reconciled evidence-bundle suites (204 passed), and the repo-policy, requirement-governance, and formal/spec-coverage gate scripts (all green) with RAES_REQUIREMENT_UID=API-404. CI owns the repository-wide suites.

Ground Control Checks

• Repository policy checks required in CI before merge
• Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: API-404 ← implementations/python/packages/raes_runtime/control_plane_api/_responses.py, API-404 ← implementations/python/packages/raes_runtime/control_plane_api/_operation_routes.py, API-404 ← implementations/python/packages/raes_runtime/control_plane_api/_participant_routes.py, API-404 ← implementations/python/packages/raes_runtime/control_plane_api/_workflow_routes.py, API-404 ← implementations/python/packages/raes_runtime/control_plane_api_participant_retrieval.py, API-404 ← implementations/python/packages/raes_runtime/control_plane_api_guards.py
• TESTS: API-404 ← implementations/python/tests/test_runtime_control_plane_api.py

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.