migrate sidecar identity to v3

[TheGreenCedar]

Outcome

CodeStory sidecar state now has one project identity contract across Local, Agent, broker, retrieval, and packaged-proof surfaces. Current state uses schema 3; schema-2 state remains visible for migration inventory but is never reused, trusted, or destructively cleaned as a current runtime.

Closes #1034
Refs #1032
Refs #913
Refs #899

What changed

• Versioned Local and Agent namespaces, state filenames, project/workspace IDs, and generation artifact scopes under identity schema 3.
• Bound persisted embedding selection to a redacted endpoint origin plus an install-keyed HMAC fingerprint. External endpoints cannot supply managed GPU proof.
• Bound managed native reuse, trust, and stop decisions to exact executable identity, argv, endpoint/port, and process-start identity. A live process without an exact persisted start identity is unverified; a dead PID remains distinguishable so stale ownership can be reaped.
• Kept legacy schema-2 state inventory-only while reconciling an in-flight compatible worker's terminal repair result into current status during migration.
• Preserved the simplified packaged-proof harness from [codex] simplify macOS packaged proof #1073. The final proof delta against current dev is limited to identity-v3 helpers and live assertions, including the stable Darwin /bin/sleep exact-identity probe; the deleted speculative fake CLI/cleanup/status matrices were not restored.

Final integration

• Current PR head: 4b8dd7439af0a780e868b7149c7e110530ae431c
• Current dev base: 6c4e7d6aa482cc910c01cdd672d0efe943fa2929
• Final base merge: 6ba684a3c2d728aa70ca6893985e6e39f9be8789
• The merge retains [codex] prove grounding-only managed plugin convergence #1058's managed-convergence fixes, [codex] use native process time for windows embedding snapshot #1072's Windows creation-time identity, [codex] simplify macOS packaged proof #1073's proof simplification, and guard non-rust evidence boundaries #1056's corpus boundary.

Verification

Final integrated head:

• cargo fmt --all -- --check — passed
• cargo check -p codestory-cli --locked — passed
• cargo test -p codestory-retrieval --lib --locked — 362 passed, 2 ignored
• Focused CLI exact broker identity tests — passed
• Compatible legacy terminal-result reconciliation regression — passed
• Live-missing/dead-missing native start-identity regression — passed
• CLI sidecar-construction architecture contract — passed after routing the migration regression through the existing test-safe gateway
• python3 .github/scripts/check-packaged-agent-proof.py --self-test — passed
• node .github/scripts/check-workflow-policy.mjs — passed
• git diff --check — passed

Earlier branch evidence includes the mandatory repo-scale full-sidecar rows already recorded in docs/testing/codestory-e2e-stats-log.md.

Simplification review

The final changed-scope Rust review found no safe remaining R0/R1 extraction worth adding to this ownership-sensitive diff. It did consolidate duplicate compatible-result parsing and kept concurrency, process ownership, atomic publication, and filesystem identity code explicit. Larger long-function candidates are pre-existing or cross ownership/concurrency boundaries and are deferred rather than mixed into this PR.

Remaining proof

This cross-platform runtime-identity change receives one unsigned packaged OS matrix at the exact head after the exact-head source gate passes. Signing, notarization, and a duplicate Windows hardware lane are outside this PR's proof dispatch.

[TheGreenCedar]

Paused review-remediation checkpoint

Exact pushed head: 3e120645815521ab6063623978bf0687312a0bee.

The five review blockers are addressed in the current draft diff:

• schema-2 sidecar state is no longer reused or attached;
• cleanup requires the shared exact state/runtime contract and preserves mismatched or legacy state with an inventory action;
• state and GPU identity bind non-secret endpoint origin plus a SHA-256 fingerprint of the full endpoint, and external endpoints cannot provide managed GPU proof;
• index, retention, status, and query paths use the retained schema-3 artifact scope or fail on identity drift;
• existing tests, operator docs, and the changelog were updated without adding generated comparison artifacts.

Green non-Cargo checks:

• git diff --check
• node .github/scripts/check-doc-links.mjs

Cargo verification is incomplete/pending after interrupted compile and formatting attempts. Rustfmt changes were applied. The first focused compile found one unqualified test enum and unused compatibility code; both were fixed. A final import-layout correction was applied after the resumed formatting check, but no Cargo verification ran afterward. Focused tests, workspace check/test/clippy, the two full indexer test binaries, release build, and repo-scale e2e stats still need to run before review readiness.

PR remains draft; no merge or readiness transition was performed.