Wire contract evolution through mdbase Connect

[callumalpass]

What changed

• Carries exact contract id/version/digest requirements through manifests, grants, notification criteria, scopes, and runtime events.
• Replaces install-only operations with assess/apply type-pack evolution across browser SDK, protocol, daemon, hosted provider, MCP, portal, editor, desktop, and Pickle packages.
• Derives a pack's provided contracts in the devkit and rejects non-managed contract resources.
• Surfaces structured compatibility, planned resource actions, setup choices, warnings, conflicts, and stale-plan failures to applications.
• Makes mdbase.lock.yaml portable authority data across hosted snapshots and Rust/TypeScript mirrors while keeping scoped application projections private.
• Adds hosted schema migrations for exact notification digests and lock resources, including durable provider-side grant copies.
• Fences authority promotion from concurrent background mirror sync without timing sleeps.
• Exempts connector-generated provenance locks from user document-size quotas while retaining all user/setup resource checks.
• Adds revision-stamped, SHA-512-recorded consumer artifacts for unpublished coordinated SDK builds.
• Keeps the new editor, protocol, and hosted-provider logic in focused modules without increasing architecture budgets.
• Bumps the coordinated prerelease packages to beta.25.

Why

When a contract changed, Connect could authorize an application against the new declaration while an existing collection silently retained older resources. The application then failed later with little explanation. The control plane, providers, mirrors, and clients also lacked one exact portable provenance record.

This moves compatibility into the SDK/backend boundary: callers can inspect a deterministic migration outcome before writing, and application is exact, transactional, interruption-safe, and conflict-preserving.

Impact

This is intentionally breaking prerelease work. The obsolete install operation and partial contract references are removed. Consumers must use beta.25 assess/apply APIs and exact digests.

Depends on:

• mdbase-spec#44
• mdbase-rs#39
• mdbase TypeScript#11

Validation

• full JS/TS workspace build, typecheck, test, package audit, and architecture gate
• full Rust workspace with explicit test secret backend; only credential/environment-gated cases ignored
• exact runtime.application-execution interoperability scenario
• 247 internal editor tests, including digest-pinned adoption review
• production hosted-provider Docker image built from the pinned Rust revision and Docker lock
• main compiled daemon/direct/relay E2E
• complete disposable PostgreSQL 18/S3 hosted-provider E2E before the upstream rebase, covering migrations, quotas, notifications, browser authorization, Rust/TS mirrors, files/conflicts, authority transfers, restart, backup restore, and key rotation
• full hosted migration chain through 0024, plus a focused PostgreSQL 18 fixture proving that known Connect contracts receive exact digests while unknown application contracts and criterion order are preserved
• previous-release notification recovery canary asserts the migrated timer event's exact id, version, and semantic digest
• internal editor remote-authority and reauthorization browser scenarios