Complete Determa 0.2 lifecycle migration and Cloud validation

[fruwe]

Summary

Upgrade determa-state to >=0.2.0,<0.3.0 and use its public format-1, pure-functional APIs as the provider, provisioning, and package lifecycle authority. Add hierarchical package states, interrupted-operation recovery, monotonic operation IDs, operation-local command environments, target-scoped credentials, and required_any authentication.

Fresh Cloud validation also fixed nested observations overriding root package status, partial secret-upload cleanup, Windows payload permissions/ACL/deletion error propagation, and staged installer path quoting. CI creates the required project-local Poetry environment. The default Python suite now includes FSM tests; explicit cross-repository and actual OS-runner checks are reproducible through scripts/test-cross-repo and scripts/test-provision-runner --plugin-roots.

Validation

• Full scripts/test passed; final Python validation: 528 passed, 1 intentional skip.
• Actual Linux and PowerShell OS runners passed, including Windows explicit-exit and thrown-error cases after the companion provider fix.
• All sibling manifest conformance checks and Linux/Windows schema parity passed; 47 combined plugins loaded (7 providers, 25 packages, 11 bundles, 4 OS plugins).
• Fake-provider lifecycle, environment isolation, secret handling, operation-ID/recovery tests, real-plugin core boundary, stack generation/formatting, and CI pipeline checks passed.
• Upstream Python/spec releases and PyPI identify 0.2.0 as latest. No constraint change or upstream design workaround is needed.

Details: Cloud validation and audit.

Recovery provenance

Initial recovery commit c2c0f5a matched the supplied GitHub recovery record. The independently sanitized original patch was recorded with SHA-256 0dfce13523770ecbc94d3a38d6c69dc696734dbc53b28c746abbc5f57ea29dc6. Cloud validation used fresh checkouts, without backup files or ignored personal configuration.

Rollout

Ready to merge into v4.5, then merge companion recovery PRs. The main-facing rollout separately retains the live Windows GPU/VDD validation dependency documented in the roadmap; no billable resources were created in Cloud.