feat: add adopt-only migration lifecycle

[schickling-assistant]

Summary

• add a typed per-task adopt-only lifecycle, including the compact agent form
• adopt a live generation but hold dead or absent tasks without reap or launch
• surface held task IDs and require an explicit transition back to service before replacement

Why

Identity-based adoption is safe only while the expected generation is still
alive. Before this change, publishing a migration declaration also authorized
st2 to cold-launch an absent task or reap and replace a dead one. That makes a
zero-interruption catalog cutover race with the ordinary service reconciler.

adopt-only is a fail-closed migration fence. It does not change the default
service lifecycle, and retired #true remains the separate explicit teardown
instruction.

Addresses #98 replacement-authorization boundary. Durable generation receipts
remain the separate desired/observed generation contract tracked in #40.
The paired executable acceptance is
evals#52 /
evals PR #53.

Evidence

Red before implementation:

error[E0432]: unresolved import `st2::spec::TaskLifecycle`
error[E0609]: no field `lifecycle` on type `Task`
error[E0609]: no field `held` on type `ReconcilePlan<'_>`

Green:

• cargo test -p agent-spec --test discovery - 29 passed
• cargo test --test reconcile - 30 passed
• cargo test --test run - 26 passed
• cargo clippy --all-targets --all-features -- -D warnings - passed
• cargo test --no-run --all-targets --all-features - passed
• Nix CI nix flake check --print-build-logs - passed
• paired eval against exact head f32273d: 7 PASS / 0 FAIL / 7 gating

The complete all-target run reached unrelated existing test
materialize::up_materialize_only_writes_the_overlay_without_needing_pty,
which fails identically on origin/main because that test removes git from
PATH while materialization now treats the missing safety probe as an error.

Posted on behalf of @schickling

field	value
agent_name	co2-bear
agent_session_id	a078daee-6f98-4916-91a8-d21291407789
agent_tool	Codex CLI
agent_tool_version	0.145.0
agent_runtime	Codex CLI 0.145.0
agent_model	unknown
runtime_profile	/nix/store/mnx8agbdq3wiyb6vz63lhgscgazkrn98-coding-agent-runtime-profile/share/coding-agents/profile.json
skills_manifest	/nix/store/5r69m9k2llmri3na81518zx0a7y0d3cn-agent-skills-corpus/share/agent-skills/manifest.json
worktree	st2-adopt-only-migration/schickling/adopt-only-migration
machine	dev3
tooling_profile	dotfiles@0fb7e03