Add an adopt-only lifecycle for zero-interruption migrations

[schickling-assistant]

A live migration can publish a declaration for an already-running task and rely
on identity-based adoption. Today that declaration becomes an ordinary restart
contract: if the task exits, reconciliation reaps the old PTY record and
launches the declared command; if the task disappears between the migration
preflight and the first pass, it launches immediately. There is no fail-closed
way to say "adopt this generation if present, but never create or replace it
without a separate authorization."

Required contract

Add an explicit task lifecycle policy (name bikesheddable; this issue uses
adopt-only):

• Alive: adopt without replacement.
• Dead: retain/freeze; do not reap or launch.
• Absent: do not launch.
• Explicit replacement: a separately authorized operation or declaration
  transition restores ordinary launch/restart behavior.
• Before any authorized reap/restart, persist an immutable generation receipt
  containing enough bounded process and PTY metadata to diagnose the prior
  generation.

The policy must be part of the effective launch contract and machine-readable
inspection output. It must not be inferred from comments, arbitrary metadata,
or backend keep tags.

Acceptance

• A live task is adopted; after it exits, no cold launch occurs.
• An absent adopt-only task never launches.
• Transitioning to ordinary service lifecycle permits an explicit replacement.
• Reap/restart preserves a generation receipt before removing the old backend
  record.
• Red-before/green-after integration coverage uses an isolated synthetic PTY
  root.

Relationship to existing issues

• Activation: deploy managed PTY exit-diagnostic retention #34 covers backend exit diagnostics and keep behavior. This issue requires
  the supervisor to retain a generation receipt across its own explicit reap
  path.
• Expose desired versus observed launch generation for adopted tasks #40 and Adoption matches by identity only, so a task running a superseded command is adopted as current and reported healthy #44 cover desired/observed launch-generation drift. This issue adds
  a replacement authorization boundary; it does not redefine drift detection.

The ordinary service behavior remains correct for normal declarations. This is
a distinct migration lifecycle, not a change to default restart semantics.

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	st2-adopt-only-migration/schickling/adopt-only-migration
machine	dev3
tooling_profile	dotfiles@0fb7e03

[schickling-assistant]

Implementation: #99.

Paired red/green acceptance:
evals#52 and
evals PR #53.

PR #99 implements the fail-closed replacement-authorization boundary. Durable
generation receipts remain the separate #40 follow-up.

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	st2-adopt-only-migration/schickling/adopt-only-migration
machine	dev3
tooling_profile	dotfiles@0fb7e03

[myobie]

Completed by PR #99, merged as 152cdc57cb26592d5e65a981072f91fd5b451727 from exact implementation head f32273df6c53978e6ace60e301e32fcfb457d413.

The merged contract covers both compact and explicit tasks:

• live adopt-only generations are adopted unchanged;
• dead or absent generations are reported as held, with no reap or launch;
• transitioning to service explicitly restores ordinary replacement;
• retired #true remains separate teardown authority;
• held task IDs are available in machine-readable reporting.

Implementation evidence recorded on #99 is green: agent-spec 29 tests, reconcile 30 tests, run 26 tests, clippy, and hosted Nix. Paired acceptance in evals PR #53 is RED 4/3 on pre-change f96f925 and GREEN 7/0 on exact implementation head f32273d, covering same-generation adoption, absent/dead hold, explicit transition back to service, the ordinary-service positive control, and clean teardown.

The immutable pre-reap generation receipt is intentionally not residual scope for this issue: the issue's implementation note and merged PR assign that work to existing #40. Closing the adopt-only lifecycle request as completed.