Add typed task generation inventory

[schickling-assistant]

Summary

• add st2 tasks --json as a versioned, fail-closed desired-task/runtime inventory
• persist exact strict exec generations while reading legacy PID records conservatively and without rewriting them
• join exact PTY and exec evidence behind the shared catalog boundary
• document and prove the two-phase adopt-only replacement order

This is a sibling stack directly on PR #106 exact head 57bb7452a4e5a464b752e82e282b3974be4d97fd; it is intentionally independent of PR #113. The eventual integration of both stacks has small mechanical overlap in src/main.rs and src/lib.rs.

Safety contract

The typed envelope is st2.task-inventory.v1. Unknown, malformed, timed-out, duplicate, unreadable, PID-reused, or otherwise incomplete evidence is indeterminate, sets complete: false, and exits nonzero. A missing PTY root is positively absent and is not created. Observation never reconciles, kills, cleans, or rewrites legacy state.

The cutover order is:

1. CAS active provider tasks to adopt-only.
2. Record a complete baseline behind the fence.
3. Stop only the old supervisor and start the replacement.
4. Require a second complete inventory with exact baseline generations.
5. CAS provider lifecycle back to service.

Ambiguous legacy exec records remain a truthful cutover blocker. Their narrow, explicitly authorized replacement is follow-up work; this PR does not add a general reset or mutate them during observation.

Verification

• cargo check --tests
• 7 task-inventory unit tests
• 7 strict/legacy exec-generation unit tests
• 6 existing exec-backend integration tests
• 12 task-inventory CLI/E2E tests, including packaged st2 tasks with a real PTY generation replacement
• existing hermetic real-PTY targeted lifecycle proof
• existing Nomad-style exec replacement proof
• existing Linux transport-isolation proof
• invariant proof-reference gate
• git diff --check

Independent read-only architecture/correctness review approved the final factored diff. No live catalog, supervisor, activation, or runtime state was mutated; one live-catalog inventory measurement was read-only.

[schickling-assistant]

Closing as superseded rather than rebasing.

This branch would need ~22,700 deletions to reach current main — the tree it was cut from has been reshaped by the catalog work that landed since. Reconstructing it against main would be a rewrite, not a rebase, and the reviewable content would not be the same change.

The underlying question — exposing desired versus observed launch generation — is still open as #40, which is where it should be picked up from if it is wanted.

Posted on behalf of @schickling

field	value
agent_name	unknown
agent_tool	Claude Code
agent_tool_version	2.1.220
agent_runtime	Claude Code 2.1.220
agent_session_lookup	unavailable
tooling_profile	dotfiles@unknown-dirty