qualify managed lifecycle on every platform

[TheGreenCedar]

Context

The six-cell release matrices executed every shipped archive, but managed-plugin provisioning, local grounding, repair handoff, and cleanup were only qualified on Windows x64. The other five supported targets stopped at version/help/stdio shape, leaving #921's managed lifecycle claim incomplete.

PR #986 merged as squash commit a2f0938a. This branch contains four #1031 commits on that exact base and changes only the eight lifecycle, proof, state-contract, documentation, and workflow files listed by the PR.

Closes #1030
Refs #921

What Changed

• Run the managed-plugin handoff gate unconditionally on all six native pre-publish and post-publish cells, with explicit archive extensions, per-target evidence artifacts, fail-fast: false, and workflow-policy checks that reject exclusions, conditions, and continue-on-error bypasses.
• Make proof cleanup fail closed while preserving the primary gate failure. It validates the exact proof-owned state/Compose identity, records retrieval-down and Compose teardown, requires cache absence, and captures bounded compose ps plus Qdrant logs before cleanup whenever retrieval indexing fails, including exit-zero contract failures.
• Scope non-root Qdrant execution to proof environments. The proof passes its UID/GID and places Qdrant snapshots under the proof-owned storage mount; normal runtime Compose retains the root user and /qdrant/snapshots defaults.
• Harden Windows repair-worker cleanup with typed 64-bit Win32 bindings, checked taskkill, WaitForSingleObject, and TerminateProcess outcomes, and persisted per-PID source/attempt/kill diagnostics before failure. Only the repair PID started by this proof and observed with the same attempt ID is eligible; arbitrary PIDs merely visible in status are never swept.
• Correct the sidecar-state migration direction. New state writes lexical_data_dir and no longer emits Zoekt path, port, or image keys. zoekt_data_dir remains a read-only legacy alias, and bounded legacy cleanup requires exact state-proven ownership of the old Zoekt directory.
• Update the changelog and contributor testing matrix without widening Linux-x64 full-sidecar, Apple Metal/Apple Silicon Metal sidecar needs v0.14.0 endpoint-survival validation #887, GPU, or older-glibc claims.

CI Failures and Root Causes

Run 29210464288, Linux x64 job 86697247949:

• retrieval index exited 1 because Qdrant refused connections.
• The cleanup validator then masked that primary GateFailure because it expected the test-only lexical_data_dir spelling while production state serialized zoekt_data_dir.
• The Qdrant 1.12.5 image failure was reproduced with the proof UID: it exited 101 because the non-root process could not create /qdrant/snapshots. Pointing snapshots at /qdrant/storage/snapshots under the already-owned bind mount kept the same pinned image running.
• Cleanup now accepts only an exact canonical path or exact legacy alias, never synthesizes missing ownership, preserves the primary failure, and records pre-cleanup Compose/Qdrant diagnostics.

Run 29210464288, Windows x64 job 86697247985:

• The managed repair worker PID 2628 remained nonsignaled after the old blind taskkill and TerminateProcess sequence (WAIT_TIMEOUT 258).
• The old proof discarded taskkill return/output, Win32 errors, and cleanup provenance, and used untyped ctypes calls. The historical runner evidence therefore cannot prove which termination sub-operation failed.
• The fix pins the process identity with OpenProcess before killing, uses typed HANDLE/DWORD/BOOL/UINT signatures, classifies wait results, checks all termination outcomes, persists diagnostics before raising, and limits cleanup authority to the proof-started matching repair attempt.

How To Review

1. Confirm both workflow matrices retain exactly six native target rows and the managed handoff step has no condition.
2. Review validated_proof_compose_state, capture_proof_compose_diagnostics, cleanup_proof_compose, and cleanup_proof_cache_on_exit for exact ownership and primary-error preservation.
3. Review proof_started_repair_workers and terminate_worker_pid for attempt-ID ownership, typed Win32 calls, checked outcomes, and persisted diagnostics.
4. Review SidecarStateFile serialization and migration tests: canonical writes use lexical_data_dir; legacy zoekt_data_dir is read-only compatibility; new state has no Zoekt port/image/path output.
5. Confirm the testing matrix preserves the narrower sidecar and accelerator proof boundaries.

Verification

On exact head 3056c1d2 over exact merge-base a2f0938a:

• python .github/scripts/check-packaged-agent-proof.py --self-test on Windows — passed
• The same packaged-proof self-test under Ubuntu/WSL — passed
• python -m py_compile .github/scripts/check-packaged-agent-proof.py — passed
• cargo test -p codestory-retrieval sidecar_state_ -- --nocapture — 2 passed
• cargo test -p codestory-retrieval — 333 unit tests passed, 2 measurement/live-sidecar tests ignored; all non-live integration binaries passed
• cargo fmt --all --check — passed
• node .github/scripts/check-workflow-policy.mjs — passed
• node .github/scripts/check-doc-links.mjs — 69 files, 281 relative links
• docker compose -f docker/retrieval-compose.yml config with proof UID and snapshots path — passed with user: 1000:1000 and /qdrant/storage/snapshots
• Direct pinned Qdrant repro: default non-root snapshots path exited 101 with permission denied; proof snapshots path remained running
• git diff --check — passed
• Independent review found two proof gaps; both were fixed, and the focused re-review was CLEAN

CodeStory managed runtime status was available on 0.14.3. Its local affected graph remained blocked while a local reindex was still refreshing, so no graph-impact claim is made from that unavailable surface.

Risk

The change increases native matrix work by running the existing managed proof on five additional targets. Cleanup is intentionally strict: missing, ambiguous, forged, or escaping state blocks teardown rather than targeting Docker. Historical Windows evidence cannot identify the exact old Win32 sub-operation because the old gate discarded it; the new artifact makes any recurrence diagnosable. Full sidecars remain Linux-x64-only. There is no screenshot-visible UI change.