Fix silent agent install rollback and misleading upgrade rejection (#1801) (#1806)

The bundler's import path used to claim an agent_id, mutate pipelines/flows/agent_config across
multiple unwrapped wpdb writes, and only check sub-step results for the agent insert. Under SQLite
contention on Studio that produced "success: true" responses with a populated agent_id summary while
the underlying rows were silently rolled back, leaving operators with a `Agent "..." not found` on
the very next CLI call.

This change wraps the post-claim work in a transaction with try/catch + manual rollback, throws on
any sub-step write failure, re-fetches the agent row after the final update_agent and verifies the
artifact registry actually persisted, and surfaces typed errors (`install_post_claim_failure`,
`install_invalid_bundle`, `install_slug_collision`, `install_bundle_slug_mismatch`) instead of bare
strings. The manual_rollback() path is the safety net for engines that silently no-op ROLLBACK; it
deletes only rows this call inserted, never pre-existing ones.

`agent upgrade` now passes `is_upgrade => true` so an existing agent row is treated as the upgrade
target instead of returning "Agent slug already exists. Use --slug=<new-slug> to rename on import."
when a bundle's artifacts lack `portable_slug` and the live pipelines/flows have been edited
(`local_modified`). Conflicts come back through `result.conflicts` and the CLI hands them to the
existing PendingActions staging path, matching what `agent diff` already reports.

Defensive cleanup: `InstalledBundleArtifacts::register()` listens on `datamachine_agent_deleted`
and wipes any tracked rows for the deleted agent_id. The importer does not write to that table
today, but extensions can — and a stale row would mis-classify a fresh install as an upgrade
against a non-existent agent.

Also adds two test seam actions, `datamachine_bundle_import_post_claim_started` and
`datamachine_bundle_import_pre_commit`, so tests can throw inside the critical section without
needing a live SQLite race to reproduce the bug.

Tests: tests/Unit/Core/Agents/AgentBundlerImportTest.php covers all three regression shapes:
silent partial success → rollback + typed error, upgrade-against-local-modified → success with
conflicts, agent delete → bundle artifact registry cleared.

Author: chubes4

data-machine.php

@@ -90,6 +90,7 @@ function () {
 	// Load and instantiate all handlers - they self-register via constructors
 	datamachine_load_handlers();
 	\DataMachine\Engine\Bundle\AuthRefHandlerConfig::register();
+	\DataMachine\Core\Database\BundleArtifacts\InstalledBundleArtifacts::register();
 
 	// Initialize FetchHandler to register skip_item tool for all fetch-type handlers
 	\DataMachine\Core\Steps\Fetch\Handlers\FetchHandler::init();

inc/Cli/Commands/AgentBundleCommand.php

@@ -224,7 +224,20 @@ public function upgrade( array $args, array $assoc_args ): void {
 		}
 
 		$owner_id = isset( $assoc_args['owner'] ) ? $this->resolve_user_id( $assoc_args['owner'] ) : 0;
-		$result   = $this->bundler()->import( $bundle, '' !== $slug ? $slug : null, $owner_id, false, array( 'reconcile_runtime' => $reconcile_runtime ) );
+		$result   = $this->bundler()->import(
+			$bundle,
+			'' !== $slug ? $slug : null,
+			$owner_id,
+			false,
+			array(
+				'reconcile_runtime' => $reconcile_runtime,
+				// Mark this as an upgrade so the importer treats an existing agent row as the upgrade
+				// target instead of returning "Agent slug already exists" when local pipelines/flows
+				// have been edited (#1801). Local-modified artifacts come back in `result.conflicts`
+				// and get staged as PendingActions below.
+				'is_upgrade'        => true,
+			)
+		);
 		if ( empty( $result['success'] ) ) {
 			WP_CLI::error( (string) ( $result['error'] ?? 'Bundle upgrade failed.' ) );
 			return;