Add deterministic tenant dependency normalization command

[shiny-code-bot]

Goal

Provide the shared product-owned command that deterministically regenerates a tenant workspace's canonical root uv.lock and frozen dependency export after nested workspace dependency changes.

Current Status

State: Active implementation leaf on August 12, 2026.

Launchplane issue cbusillo/launchplane#1935 identified that Dependabot can update a nested tenant workspace manifest while leaving the canonical root lock stale. Strict tenant CI correctly rejects that state. The shared generation behavior belongs in odoo-devkit; Launchplane and tenant workflows may orchestrate it but must not reimplement lockfile logic.

Finish Line

A deterministic product-owned command regenerates canonical tenant lock/export artifacts, reports provenance, passes strict post-checks, and is idempotent.

Acceptance Criteria

• Reuse the tracked workspace manifest and existing dependency-workspace inspection contract.
• Regenerate the canonical root uv.lock without broad dependency upgrades.
• Produce the same frozen export shape used by tenant CI.
• Emit machine-readable source/tool/artifact provenance without secrets or private topology.
• Preserve measured no-change as a successful idempotent result.
• Fail before publishing when normalization or the strict post-check fails.
• Add focused unit/integration tests and update shared docs and .github/github.json when command metadata changes.

Relationships

• Parent: cbusillo/launchplane#1935.
• Blocks the OPW trusted write-back workflow leaf.
• Related dependency-health contract: cbusillo/launchplane#1932.

Next Action

Implement the command against the current manifest/dependency workspace abstractions and prove it on a temporary nested workspace fixture before wiring any write-capable workflow.