Exercise published SDK workflow update directions

[rmcdaniel]

Change

Adds actual published SDK execution for all nine PHP/Python/Rust client/update-handler directions. Uses the existing Sample App workers, an ordinary isolated Compose command and a repository-local Actions check. The installed Python SDK surface shard in the Server runner uses simulated HTTP responses, so this experiment also supplies its live Server round trips.

The observer checks SDK result and durable update identity/history, then accepts work while the Rust process is killed and verifies completion and duplicate identity in its replacement. It also checks a durable handler failure, Rust's explicit unsupported-validator contract and final completion of the original workflows.

Part of durable-workflow/.github#122. The existing Server update runner retains its PHP/Python scope. This is a separate executable experiment and does not replace its validator or operator diagnostics cells.

Validation

Shell/Python syntax, PHP lint, formatting, whitespace checks and all 55 Python metadata/verifier checks pass in containers. Focused cases reject duplicate/missing/out-of-order completion, wrong update identity, failed completion presented as success and changed handler/payload types. They check complete history pagination, original run identity, the API's result envelope field and a matching durable handler failure behind the published Python exception. Published runtime checks and ordinary repository checks must pass before merge.

The live run exposed incomplete Rust command declarations. Rust SDK #71 supplies query/update argument contracts and #72 adds explicit signal declarations. This PR uses published Rust 3.3.0, declares the workflow's completion signal and updates only Rust in the frozen tuple and both lockfiles. Server remains 2.5.9.

Published update qualification passed on 3f19dd6, UTC 2026-10-08 00:07:59 to 00:11:28. All nine directions pass before and after Rust replacement. Accepted work while the Rust process is absent, original update/run identity, duplicate completion, durable handler failure, typed validator refusal and all three original workflow completions pass. Server digest: sha256:11c11e11498b63e644d906e43f49810a1bc0b5298f750734fe0edb279c622bca. Other tuple versions: PHP 2.2.3, Python 2.4.2, CLI 2.1.3, Workflow 2.5.3, Waterline 2.3.1. Runtime cleanup succeeds.

The same head passes all twelve published timer/recovery cells, the candidate image check, ordinary application/microservice CI, both smoke checks and the public-boundary policy. Merged main repeats the complete update experiment and all ordinary/timer checks successfully.

Main image publication passes native amd64/arm64 startup and attestation checks. Anonymous GHCR/Docker Hub immutable and main indexes have the same digest sha256:26c2d3d831076af5391a606ab7341d27fbb55ccf31b4b2f5591d7011eebdacee. Both architectures' configuration labels identify source 87e4bd14788c5cbb77a030213fbca621d940266d. Immutable tag: sha-87e4bd14788c5cbb77a030213fbca621d940266d-run-37706746571-1.