Add durable Agent command delivery core

[hotzenplotz5]

Status

Tested Draft Phase-63 Slice 3A runtime foundation. Keep this PR Draft until the user separately authorizes Ready. Do not merge or enable auto-merge without a later separate explicit authorization.

Exact-head VDR-Suite CI #7326, run ID 31073906749, completed successfully on a796ee4343ac83a6a08c189abd48507aed1c8f16.

Scope

This PR implements the durable command-state core required by the merged Phase-63 command-delivery contract:

• bounded vdr-suite-agent/1 command envelopes with distinct operation/job/attempt/claim/command/Agent-instance/Backend-generation identities;
• Suite-owned SQLite command ledger and repository boundary;
• idempotent assignment creation and conflicting-fingerprint rejection;
• exact-fence receipt/result recording and result acknowledgement;
• deterministic assignment lookup for one current Agent binding;
• atomic service-private Agent inbox/result-outbox records;
• durable receipt before local acceptance;
• restart-safe not_started, starting, accepted_by_executor and effect_reported states;
• duplicate replay, conflict, stale-generation/instance and deadline handling;
• focused C++ tests included in test-fast;
• explicit runtime-slice documentation.

Deliberate split

This is the first bounded runtime sub-slice after contract PR #142. It establishes the durable state machine and persistence boundaries before network wiring.

The immediately following separate Draft will add protected outbound-only assignment/receipt/result transport, reconnect ordering and a non-mutating exact-head yaVDR acceptance runner.

Hard exclusions

This PR adds no command HTTP route or Agent polling loop, no installed command capability, no native executor, no VDR mutation, no Recording/Timer/SearchTimer/Remote/configuration/metadata command, no provider ownership or SuiteBridge selection, no public Agent/provider URL and no Phase 64 code.

The test-only delivery-probe string is not registered as a production command capability and is not reachable through the installed Agent.

Exact base and tested Draft head

Base: main @ 2f613b1b1a889d104b78b96f2d7d638724c315c4

Tested Draft head: a796ee4343ac83a6a08c189abd48507aed1c8f16

The comparison is ten commits ahead and zero behind because temporary self-removing bootstrap commits remain in branch history. The durable diff contains exactly six files, 1,211 additions and two deletions; no temporary workflow or bootstrap helper remains.

Validation

A self-removing bootstrap workflow first used the repository's actual compiler/toolchain to run:

make test-backend-agent-command-delivery
git diff --check

Both passed before publication.

VDR-Suite CI #7326 then passed on the exact Draft head:

• docs-check: success;
• make-test-audit: success, including strict Make/test inventory and full graph dry-run;
• frontend-regression-test: success;
• packaging-regression-test: success, including packaging and install staging;
• fast-regression-test: success, including the new durable command-core test, all existing Agent regressions and production daemon build.

The focused C++ test proves bounded validation, durable receipt-before-acceptance, restart reconstruction, equivalent duplicate replay, conflicting duplicate rejection, stale instance/generation and deadline rejection, durable starting, result persistence/replay, conflicting result rejection and exact result acknowledgement.

Real-system acceptance

This sub-slice adds compiled core classes and tests but does not wire them into the installed daemon or standalone Agent. There is no reachable installed command behaviour, no service/configuration change and no native state access. Therefore this sub-slice requires no yaVDR installation or runtime acceptance.

The next transport-wiring PR will require exact-head installation and non-mutating real yaVDR acceptance before Ready.

Next step after separately approved merge

Open a separate bounded Draft that wires protected Agent-only assignment, receipt and result transport to this core, preserves result-first reconnect ordering and proves the path on the real yaVDR host without any native VDR mutation.