[lweberru]

Application Plan failures currently show only plan_failed: the UI exposes execution logs only for Apply, and immutable Application report storage accepts the first startup snapshot but rejects every changed progress/failure snapshot.

This change exposes requester-only Plan/Drift/Destroy logs and enables redacted Application progress publication. Migration 063 permits only output ciphertext/hash/truncation updates during the existing exact-bound active dispatch. All three report paths retain session, delegation, claim, ticket and dispatch authorization; artifact/recovery conflicts, binding metadata and completed records stay immutable. Existing stored snapshots and customer State are preserved. A newer failed Destroy Plan now selects its own diagnostics instead of an older Destroy Apply's logs. English/German user and execution documentation describes the behavior.

This repairs proven diagnostic blockers. It does not claim to resolve or qualify the underlying Corporate OpenTofu failure, whose later output was rejected and cannot be reconstructed from its first stored snapshot. No customer Plan/Apply or deployment was performed.

Validation:

• Full npm run check: 1,000 tests passed, 71 environment-gated tests skipped; build/typecheck/lint/Assistant contract checks passed.
• Real isolated PostgreSQL identity/Application suite: 51/51, including repeated/idempotent output for nondelegated Plan, delegated Plan and delegated Apply, changing truncation, requester-only reads, direct runtime write denial, immutable artifact/metadata and terminal output.
• Worker progress tests cover both brokers, publication failure/recovery, redaction and cleanup; a failed Application Plan retains its diagnostic and uploads no executable artifact.
• Complete organization/Application browser suite: 112/112 desktop/mobile cases passed, including EN/DE Plan failure output, existing Apply/Drift/Destroy flows, and a new failed Destroy Plan after an earlier Apply.
• Independent code/security review completed; reported Destroy retry-Plan selection edge fixed and regression-tested.
• Combined with feat(configurator): archive and delete unused application templates #133 in a temporary local merge: build/typecheck, PostgreSQL 51/51 and targeted desktop/mobile catalogue/diagnostics 14/14 passed; merge preview was conflict-free and discarded afterward.

Scope: hosted Public/Corporate Application execution diagnostics; no native Accelerator input changes, production operation or customer infrastructure Apply. Merge is not deployment approval.