test: record hermetic predecessor Ding behavior

[schickling-assistant]

Scope

Stacks one opt-in Linux-only hermetic predecessor-behavior gate on merged #119. Relative to exact merged-main dependency 7151d8562fff891a7d2bef6dc02b4980bf115041, this PR adds only tests/predecessor_ding_migration.rs; it imports no CAS, catalog-authoring lock, authoring, or lifecycle implementation.

The fixture demonstrates that one exact public predecessor drains one test-owned Ding sidecar recorded as a legacy numeric PID under isolated, no-concurrency conditions. The current candidate then preserves the provider and adversarial sentinel PTY generations, GCs the dead numeric record, launches one strict versioned Ding generation, and reports a complete typed inventory. Migration declarations are read-only and provider-bearing migration catalogs fail closed.

Production retirement boundary

This test is hermetic predecessor-behavior evidence. It does not exercise concurrent PID/PGID reuse or generation-record replacement. The predecessor still signals a numeric process group, and candidate GC still removes the legacy record by pathname. The test therefore does not authorize production migration or cutover. Issue #121 gates production legacy exec retirement.

Public predecessor receipt

• Source: c6846f6239329f0803142afc06c15a07b93937c1
• Legacy writer evidence: that revision src/exec_backend.rs writes child.id().to_string() to the .pid record after spawning
• Teardown implementation: the same revision parses that numeric record and signals the task process group; catalog down routes through that backend. This identifies the exercised code and does not make the signal race-free.
• Pinned build image: docker.io/library/rust@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073
• Locked dependency input: Cargo.lock SHA-256 56d7956f328d7525eea04c70f5767acb3bc207c9509e7e2cc332444a4ede2f3e
• Derivation: exact source at the revision above, clean CLI_BUILD_STAMP for c6846f6, then cargo build --locked --release --bin st2
• Binary SHA-256: 6493b0284462a5cc8c7eba8d81c0995f6ea4f738ecfb2c848991847b0c0d9624
• Reproducibility: two independent target directories produced byte-identical binaries with that SHA-256

The selected gate validates the complete pin, verifies the binary digest and clean source version before execution, and fails before execution when the artifact is absent or mismatched. It makes no claim about the previously cited unavailable private-store artifact.

Verification

At exact restacked head b88cda07438f2112884d6e1b572e020e63b7fa8a:

• Fresh hermetic Linux real-PTY predecessor behavior gate: 1 passed
• Fresh default predecessor test target: 3 passed, selected real-PTY gate explicitly ignored
• Missing-artifact negative: expected nonzero before execution
• Digest-mismatch negative: expected nonzero before execution
• cargo test --workspace --all-targets -- --test-threads=1: green
• cargo clippy --workspace --all-targets -- -D warnings (with the two existing base allowances): green
• Exact-file Rustfmt and git diff --check: green
• Hosted Nix run 30627020420, job 91144536356: success at exact restacked head
• Semantic restack proof: final tree a0937ef3226ac1dfdc158269bddb114a391916f9 and binary delta SHA-256 caea894054bb7dccdfe78f930ebdda0cc930166e06d95a091115f5bb9a9d2220 are identical before/after
• Fresh selected/default/negative/workspace/Clippy/exact-file-Rustfmt/diff gates: green
• Post-gate test-owned PTY/process residue: zero

Review order

Review and merge the dependency stack base-to-tip: PR #117 → PR #119 → PR #118. Do not merge a child before its base. If a base merge rewrites ancestry, restack the child without semantic change and require a fresh exact-head hosted check before later merge handoff.

All required hermetic local and hosted acceptance gates are green at the restacked head. No live catalog or runtime mutation.