feat(runs): add lifecycle journal kernel

[solomonneas]

Summary

Adds the journal kernel for #568 without wiring it into active run transitions yet.

• Defines the canonical brigade.run_event.v1 envelope, event registry, payload allowlists, and deterministic digests.
• Appends one bounded JSON line with expected-sequence checks, digest chaining, idempotency conflict handling, byte-count verification, and fsync.
• Rejects noncanonical or malformed history before deriving append state. Readers return only the verified prefix after the first chain error.
• Preserves partial tails in collision-safe quarantine files before recovery truncates the journal.
• Keeps journal artifacts private on POSIX and provides a symlink-checked fallback for platforms without O_NOFOLLOW, O_DIRECTORY, or fchmod.

Design notes

event_id contains the first 12 characters of event_digest. The digest input therefore excludes both event_digest and event_id. Including event_id would require a SHA-256 fixed point.

This PR stops at the typed storage kernel. It does not change aboyeur.py, write lifecycle events from live runs, or project them into run.json. Those changes belong to the next #568 slice.

Verification

• python -m pytest tests/test_run_events.py tests/test_run_journal.py -q: 86 passed.
• ./scripts/verify: 4,816 passed, 3 skipped, 82.91% coverage. Ruff lint, Ruff format, mypy, version sync, and managed snapshot checks passed.

Part of #568.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dbad8158-b51a-4c0f-a906-9b76a7f8808a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/568-1-journal-kernel

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}