Implement AP-SPEC-0038 open production runtime

[bordumb]

Summary

Implements all nine AP-SPEC-0038 open-core production epics as an end-to-end, production-shaped Auths surface.

• freezes the open production contract and compatibility boundary
• qualifies a PostgreSQL lifecycle store and durable recovery behavior
• hardens external custody through AWS KMS and PKCS#11 adapters
• adds privacy-safe operational events, support bundles, and OpenTelemetry export
• qualifies exact-effect GitHub, OpenTofu, and PostgreSQL verticals
• delivers matching Rust, TypeScript, and Python production clients
• ships a runnable Compose/Kubernetes open-production reference deployment
• adds immutable, signed release-assurance evidence and CI policy gates
• includes the interoperability fixtures and integration guidance carried into this branch

The normal SDK path remains small and type-driven while the operational surface is progressively disclosed. Protocol meaning, retry safety, lifecycle state, effect commitments, and recovery metadata remain Rust-owned.

Product impact

A user can configure a production client, connect durable state and external custody, authorize an exact effect, execute through a closed provider gateway, recover safely after interruption, and diagnose the result without leaking authority or sensitive payloads. TypeScript and Python expose the same bounded product contract.

Validation

• pre-commit applied and passed before every epic and repair commit
• full Python SDK validation: 87 tests, Ruff, strict MyPy, strict Pyright, public API/package/native/docs/source/installed typing contracts
• CARGO_INCREMENTAL=0 cargo xtask ci
  • full default and all-feature Rust test matrices
  • Clippy, rustdoc, MSRV, source-boundary, architecture, semantic-freeze, and compliance gates
  • Lean, Aeneas qualification, Kani, differential fixtures, golden vectors, and fuzz smoke
  • packed npm SDK, reproducible abi3 Python wheel, modular Cargo consumers, and live-demo validation