feat(config): add durable apply transactions

[pimlock]

Summary

Add Stage 3 durable completion semantics for sandbox-scoped policy and settings mutations, then remove supervisor configuration polling. Desired state and its operation commit atomically; WAIT_FOR_APPLY returns only after the exact policy/settings revision tuple reaches a durable terminal state.

Stage 3 logical transaction, state diagram, and overall flow

Related Issue

Part of #1731.

Stacked on #3265.

Changes

• Add durable configuration operations with pending, applied, inactive, failed, superseded, and cancelled states; expose operation lookup, idempotency keys, commit-only mode, and bounded server-side waits.
• Commit sandbox desired state, annotations/resource-version CAS, and operation records in one SQLite or PostgreSQL transaction, then reconcile pending operations with paginated scans, CAS claims, and bounded retry backoff.
• Complete operations only from an exact correlated supervisor result or authoritative lifecycle state, preserving superseded and retained-local-override semantics.
• Require release-matched supervisor protocol revision 3, complete stream bootstrap, and stream-only runtime updates; remove obsolete supervisor fetch RPCs and compatibility branches.
• Update the CLI, Go and TypeScript SDKs, architecture, operational docs, generated bindings, and E2E coverage.

Testing

• mise run pre-commit
• mise run ci
• mise run sdk:ts:ci (105 tests)
• mise run go:ci
• mise run e2e (MCP and Python passed; one transient custom-image assertion observed the correct runtime rejection)
• OPENSHELL_E2E_DOCKER_TEST=custom_image mise run e2e:rust (3/3 passed on focused rerun)
• mise run e2e:rust (full configured Docker Rust lane passed)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated
• User-facing docs and SDK contracts updated
• No generated TypeScript sources committed

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3273.docs.buildwithfern.com/openshell