feat(managed): compose reviewed runtime capabilities

[allisoneer]

Summary

Compose the three independently reviewed Managed NAC runtime capabilities on the exact dev base without importing the allison-demo stack:

• ALL-12 / feat(managed): bind Arcee auth to explicit issuer (ALL-12) #239: server-authoritative Arcee auth repair binding
• ALL-40/41 / feat(managed): add durable release-aware upgrade control #242: private, durable upgrade-maintenance control
• ALL-35 / ALL-35: delegate isolated Exa credentials to workers #237: worker-only native Exa credential transport

This integration reconciles strict managed config v2 with auth bootstrap/repair while retaining config v1 compatibility, preserves upgrade admission and restart fencing, and exercises the composed contract in the production binary and managed image. It also closes an exact-head review finding by making public managed SessionManager construction enforce process hardening and native-credential capture before config/store/runtime construction.

Exact provenance

• Base: dev at 0f13b9912017c92b4edc4c8b1bec8b40d8355c69
• feat(managed): bind Arcee auth to explicit issuer (ALL-12) #239: 7f46e5164deceb27b22a03fd1f10595d5e1c41d0..2e4586242cf40b8d640a9a7f330ed69af2bb82da
• feat(managed): add durable release-aware upgrade control #242: 83bdb4b3538566a74806b7e5756987eec824a1db..d55dc0c3c9f2067c85a3910a1f4b836fcf0b69a1, excluding unrelated 35b4cead6926ad9da9d0da7da110dbf5bee0de92
• ALL-35: delegate isolated Exa credentials to workers #237: 6ea8946520664fe27404881fb149e53c5f60a389..cf5914b5a38b85b6f4c7ac36d5ff5157d0af5f08
• Integration head: 414af989de7c108cab46844bf62f186c2a301f85

All integration commits are SSH-signed. The allison-demo branch/base stack was not merged or imported. A read-only future merge simulation identified expected textual conflicts only in crates/nac-core/src/store/schema.rs and crates/nac-server/src/tests/managed_delivery.rs; no merge was performed.

Cross-fit coverage

• strict config v2 parses auth bootstrap, issuer, host incarnation, private control listener, and JWKS together; v1 rejects v2-only fields
• managed auth repair holds host maintenance admission until server-authoritative completion
• the production image fixture uses the complete v2 auth/control contract with root-owned read-only config/JWKS and durable runtime-owned restart canaries
• managed public-library startup removes ambient native credentials, applies Linux same-UID inspection hardening, blocks an adversarial procfs probe, and remains idempotent across multiple managers

Verification

At exact head 414af989de7c108cab46844bf62f186c2a301f85:

• make setup — passed
• focused managed/core/server credential, auth-repair, upgrade-control, and config tests — passed
• make crate-test CRATE=nac-server — 187 library + 23 binary + stable contract passed
• make ci — passed (Rust workspace, 47 web files / 268 tests, format, clippy, source size, OpenAPI/types, assets, production build, static image contract)
• make test-durability — passed
• make test-e2e — 21/21 passed, including managed Exa delegation and managed onboarding
• make test-managed-image-contract — passed
• make test-managed-image — passed on the real Linux/amd64 image, including restart/auth persistence, capability bounds, and Git LFS

One first final-head CI attempt observed the existing catalog global-state test mismatch (ProviderDefault vs Baseline) after 1,250 core passes; the test passed immediately in isolation and the complete clean retry passed.

Independent review

Bounded exact-head security/durability review initially found one P1: managed credential isolation could be bypassed through the public library constructor. Commit 414af989 moved the invariant to managed SessionManager::new and added the adversarial subprocess coverage above. Re-review accepted the exact head with no remaining P0/P1 findings.

Deliberately not performed / remaining live gates

• no real provider prompt (separately authorized credentialed acceptance)
• no remote controller/Flux/staging secret-safe acceptance because exact external deployment heads and environment are separately gated
• no image publication, tag, beta alias move, deployment, merge, or release/status transition

Refs ALL-47, ALL-12, ALL-35, ALL-40, ALL-41.