feat: add private opt-in outcome transport

[neonwatty]

Transfers P5's one immutable original-delivery event to the P7 SQL contract through a private injected transport. A lost reply after SQL commit replays the same event and all 17 original values; P5 is acknowledged only after confirmed applied or duplicate acceptance. This path never generates an event, signs a token, or invokes GitHub/customer delivery.

The new command, dispatcher, consumer and SQL adapter enforce exact bounded schemas, fixed two-second budgets, explicit parameter casts, original delivery timestamps, immutable nullable version metadata, and the original delivery-acceptance-plus-720-hour cutoff. The consumer rechecks the same P5 command after SQL completion and before acknowledgement. Expired/deleted results, malformed responses, unknown commits, and timeouts cannot acknowledge acceptance; typed SQL conflicts quarantine without leaking private errors. Existing P5 custody and alarms are unchanged.

Validation:

• npm run validate: lint, formatting, typecheck and 2,494 tests across 149 files passed, including 64 new outcome tests.
• make check: all repository gates passed.
• Strongest failure test: actual workerd is disposed after a synthetic SQL destination durably accepts the command but before the source receives its result. Restart finds P5 pending, replays the identical event/17-value tuple into one SQL receipt, then acknowledges. Outbound provider calls remain zero.
• Tests cover frozen vectors, nullable/legacy fields, concurrent consumers, changed command/event conflicts, ambiguous commit, malformed/unavailable SQL, acknowledgement failure, bounded stalled operations, late replies, expiry before purge, and the independent P5/delivery deadlines.
• Independent correctness, tests, simplification, silent-failure, contracts/types and comments reviews found no actionable defects. Native codex review --base 4def4722646af74f797018df4529abb922ad885f also found no actionable defects; its sandbox could not resolve outcomes.bugdrop.localhost, so native runtime execution is not claimed. Parent and independent actual-workerd runs passed.

The transactional SQL test destination is a synthetic SQLite fixture. This package provisions no SQL login, pool, route, binding, network authentication, retry scheduler, credential, or deployment. A separately qualified authenticated transport/executor must run as bugdrop_outcomes and report success only after confirmed COMMIT; real PostgreSQL execution and permissions remain integration qualification. The consumer accepts only P5's original authorized/none event, not later-outcome ownership.

Unrelated non-blocking follow-up remains open: an unchanged uninstall retry-count test once reported seven calls instead of eight. It is neither fixed nor root-caused. Subsequent full runs and 20 traced replays passed. On recurrence, preserve per-step response, attempt count, storage/alarm and SQL trace before restart. Prior evidence: #394 (comment).

Base: 4def4722646af74f797018df4529abb922ad885f. SQL contract: web 02163f0c91d4546ca0711efb592e102b2913a79a. P5 private receipt SHA256 097d72f467ab53c5a920b4f0d2d3d4234d3dd45dbfd30df363eae867c384fc8c. No merge, deployment or activation requested by this PR.

[neonwatty]

Final runtime independent review and data cross-review are CLEAN at exact head 6caa995 against base 4def472. All executable PR checks are green. Manager authorized protected merge-queue entry with expectedHeadOid; no bypass.

Distinct unresolved non-blocking follow-up: an independent full validation observed HTTP 503 instead of 200 for the second fresh continuation in test/managed/uninstall-recovery-runtime.test.ts:241 (“rejects old signed continuation after multiple cycles without retaining routing”). That run had 2,493 passing tests and one failure. One full rerun passed 2,494 tests; all 64 P6 tests passed in both runs. The isolated continuation test and 50 traced replays also passed. None of the failing fixture’s 20 bundled source inputs changed in P6. This does not establish root cause, and the failure is neither fixed nor root-caused.

On recurrence, preserve the first 503’s pre/post tombstone and state, recovery-attempt identity/count, alarm response, recovery-binding call/status, SQL/edge trace, and storage-sync evidence before restarting. Investigation receipt: /tmp/bugdrop-p6-uninstall-continuation-investigation.md. Preserved failing log SHA256: 161240959af3556912431d6b38ca5ae1d545e578c394f1e633215c4707602fba. Trace SHA256: f7a85c69ab396e230c0f04bbbac21bef28ecc1f1a7c64f2b0bf43770803ad1f9.

This is separate from the earlier unresolved uninstall seven-versus-eight SQL-call failure. Real executor COMMIT/authentication, transport and scheduling remain integration qualification gates. No manual deployment, activation, credentials, provider changes or live tokens are authorized.