feat(libvirt): publish configuration-bound realization envelopes

[Brad-Edwards]

Summary

Publishes configuration-bound realization envelopes for the generic and TechVault libvirt modes, binds their identity through planning and execution, and fails closed when configuration, manifest, plan, or snapshot claims disagree.

Requirement UIDs

• ASR-519

Related Issues

Closes #100

ADR Impact

• ADR-019 (amended)
• ADR-070

Changes

• Publish realization-envelope-v1 schemas, fixtures, semantic invariants, and governed generic and TechVault artifacts.
• Derive libvirt manifest capabilities from the selected envelope and reject unknown, mismatched, broader, incomplete, or stale claims before driver I/O.
• Carry envelope identity through plans, snapshots, API/storage paths, and narrow existing conformance language to the evidence actually observed.

Test Plan

• Canonical nox verification passes
• 3,104 unit tests pass with 92% coverage
• 30 integration tests pass
• Schema publication, generated-schema parity, authority, repository policy, and docs build pass
• Pre-push Codex and test-quality reviews completed

Ground Control Checks

• Repository policy passes
• Ground Control quality gates pass
• GRC screening records no security-relevant impact or gaps

Traceability

• IMPLEMENTS: ASR-519 ← implementations/python/packages/aces_contracts/realization_envelope_carrier.py, ASR-519 ← implementations/python/packages/aces_backend_libvirt/target.py, ASR-519 ← implementations/python/packages/aces_backend_libvirt/provisioner.py, ASR-519 ← implementations/python/packages/aces_processor/planner.py
• TESTS: ASR-519 ← implementations/python/tests/test_realization_envelope_contract.py, ASR-519 ← implementations/python/tests/test_libvirt_backend_envelopes.py, ASR-519 ← implementations/python/tests/test_libvirt_backend_provisioner.py

Checklist

• Code follows project coding standards
• Native driver I/O occurs only after envelope admission
• Published contract and authority metadata are synchronized
• Changelog fragment: N/A per repository plan rules; Conventional Commit history is the release signal
• Architectural and conformance documentation updated

Documentation

Updated: formal semantics, backend conformance guidance, normative authority documentation, ADR-019, and ADR-070.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud