feat(k8s): Kubernetes backend plugin + desktop deploy path

[tlongwell-block]

Kubernetes backend plugin (crates/buzz-backend-kubernetes) + desktop deploy path

Implements docs/remote-agents.md (merged @ 28ae6cd) as ONE PR: the provider
binary, the desktop changes that make it work, the harness inactivity reaper,
the Sprig image, and the conformance/live-test suites.

Channel: buzz-remote-agents (29414326-dba7-402d-b384-b1b34d63a2e6), thread c42b70ef.

What's here (by lane)

• crates/buzz-backend-kubernetes (Dawn): stdin/stdout JSON provider, info +
  deploy; pure classify.rs (one match arm per spec state-machine row);
  reconcile/GC with ownership-marker gate + same-clock orphan check; per-attempt
  immutable Secrets; three-tier env with clear-then-write authoritative tier.
• Desktop (Mari): KD3 launch block from resolved descriptor, KD5 pre-secret
  negotiation gate (resolve-once → stage-and-digest → info → protocol gate →
  deploy), KD1 Windows extension strip, bundling (externalBin + Justfile +
  release/canary workflows + stub loops), tauri.windows.conf.json platform
  override (Decision B: no Windows artifact).
• buzz-acp (Max): KD4 BUZZ_ACP_EXIT_AFTER_INACTIVITY reaper (pool-independent;
  reset only at accepted dispatch; in-flight turn/heartbeat defers, never resets);
  BUZZ_ACP_EXIT_AFTER_INACTIVITY + BUZZ_ACP_NO_PRESENCE reserved. KD8 fix.
• Image + tests (Perci): Dockerfile.sprig (digest-pinned bases, exec buzz-acp
  PID 1, relay-scoped credential config), image contract script, provider
  conformance suites (golden wire fixtures shared with desktop tests), live-local
  runbook (namespace-scoped, shared-cluster safe).
• Docs (Sami, first commit): citation re-pin c1bca1b → 28ae6cd (44/49
  were already byte-exact; 3 offsets fixed) + I3 presence-bound correction (below).

Named spec deviations (deliberate, each with rationale)

1. No baked default image yet. ghcr.io/block/buzz-sprig is unpublished
   (verified: anonymous pull 403 vs control 200). Omitted image returns an
   in-band field-required error instead of a default.
2. Image override STRICTER than spec §Image: digest-only
   (name@sha256:<64hex>); ALL tags rejected; name:tag@digest normalized.
   With no baked default the override is the only path, so tag-acceptance would
   make mutability the v1 norm. Strictness is reversible; a moved tag under an
   nsec is not. Baked digest default + tag re-acceptance = follow-up with image
   publish.
3. imagePullSecrets not in schema (v1). Explicit user images may rely on
   namespace-preprovisioned pull credentials — the substrate boundary. Field
   added only if the publish decision proves it necessary. 9-field budget intact.
4. Decision A closed: writable empty workspace. Nest projection = named
   follow-up; no image-side scaffolding.
5. Decision D overridden by Tyler (event b55398d8): provider ships bundled
   with the desktop like buzz-acp/buzz-agent; spec §Distribution's separate
   release workflow deleted for v1.
6. I3/vision presence bound corrected 90s → 180s. PRESENCE_TTL_SECS moved in
   perf(presence): reduce heartbeat frequency #3783 during this spec's base→merge window; the number was inherited, not
   chosen. Spec :206/:216/:928 + inline quote + VISION_REMOTE_AGENTS.md:59
   corrected. ← Tyler: the vision is your document; this edit is flagged for
   your explicit eyes.
7. Spec citations are pinned to 28ae6cd (main at spec merge) and resolve
   there, not at this PR's head — this PR's own lanes move
   crates/buzz-acp/src/lib.rs by ~100 lines (19 citations across KD4/KD6/KD7/
   §Stop/§Launch data). Known Defects rows fixed BY this PR retire on merge;
   the section documents main as of the pin.
8. KD7 grace tension declared: pod terminationGracePeriodSeconds=60 vs
   KD7's measured ~87s shutdown tail at parallelism 10 (~197s at cap 32).
   KD7 is ruled out of scope, so L1-3's "enough grace for full graceful
   shutdown" is NOT met at default config — deliberate, resolved by the KD7
   follow-up, not silently.

Question for Tyler

Will ghcr.io/block/buzz-sprig publish PUBLIC? If private-by-policy, §Image needs
an imagePullSecrets story before the baked-default follow-up can land.

Out of scope (named follow-ups)

KD6 exit-code contract + KD7 shutdown budget (gate OnFailure), OnFailure restart
policy, Windows provider binary, PVCs/nest projection, mesh deployability,
sprig image publish workflow + baked multi-arch digest default.

Reproduce locally (four traps that cost us real time)

1. Git hooks inherit the invoking shell's PATH — pin the shell, not just your
verification commands. rust-toolchain.toml pins 1.95.0, but the rustup shim
that honors that pin lives in ~/.cargo/bin. If Homebrew's cargo is earlier on
PATH, cargo in this repo is 1.89.0, which cannot build the workspace at all:

$ /opt/homebrew/bin/cargo check -p buzz-db
error: rustc 1.89.0 is not supported by the following packages:
  sqlx@0.9.0 requires rustc 1.94.0
  ...                                                    # exit 101

Verifying with PATH="$HOME/.cargo/bin:$PATH" cargo test does not protect the
push: lefthook's pre-push → just test-unit re-resolves cargo from the
shell's own PATH, so a green local run is followed by a hook failure on a crate
you never touched. Export the PATH for the whole shell, not per-command. This
bit twice.

2. Line-scope your mutations, or the mutation edits its own detector. When
mutation-testing the respond-to guard, a whole-file sed on the mode literal
touches 5 sites — the guard and the fixtures/assertions that test it. The
mutation and its detector move together and the suite stays green, which reads
as "this code is dead" when it actually means "you deleted the experiment":

# WRONG — 5 sites, guard and tests mutate together
$ sed -i '' 's/"allowlist"/"allowlist-DISABLED"/g' src/env.rs
test result: ok. 145 passed; 0 failed          # false survivor

# RIGHT — 1 site, anchored to the guard's own definition line
$ sed -i '' '/^const RESPOND_TO_ALLOWLIST/s/"allowlist"/"allowlist-DISABLED"/' src/env.rs
failures:
    env::tests::allowlist_mode_with_an_empty_list_is_refused
    env::tests::an_allowlist_entry_that_is_not_64_hex_is_refused
test result: FAILED. 143 passed; 2 failed      # real kill

Restore by copying a pristine file back and confirming git diff --stat is
empty, not by re-running an inverse sed.

3. A completeness guard is not a correctness guard. The shared wire fixture
tests/fixtures/provider-wire/deploy-full-launch.request.json passed every test
we had while containing four classes of invented data (wrong respond_to
encoding, an env key no emitter writes, allowlist entries that fail the
harness's own 64-hex rule, a launch.env key from no descriptor layer). The
provider's tests could not have caught this: its types are deliberately
indifferent to these values (Option<String>, Vec<String>, arbitrary map), so
"the provider parses it" was never evidence that the desktop emits it. The fix
was not a stronger provider assertion but a rule about provenance — "recorded"
means executed-and-transcribed, and the desktop's whole-object equality test is
the only enforcement that can exist. See the fixture README.

4. Every drift this arc was a value that agreed with itself. Five invented
values were found, and not one was caught by an assertion failing — each was
caught by someone asking where a value came from. A named constant referenced
symbolically on both the fixture and assertion side. A sed that mutated its
own detector. Six probe rows that all died at the same unrelated error. A
descriptor struct literal compared against a fixture built from that literal
(launch.args: ["run","--session"], which the resolver actually returns as
["acp"]). The general defense is not more assertions but provenance: a stub is
a control that varies nothing, and the more faithful it looks the better it
hides. Ask what executed, not what passed.

Fixture-test determinism caveat (post-verification, Quinn + Dawn). The
desktop's whole-object fixture test calls the real resolver, which consults a
process-global harness registry whose own docs require registry_test_lock
for any test touching it. The fixture test holds no lock and is nonetheless
deterministic — but by containment, not by ordering. Measured, not derived:
planting a definition with id: "goose" directly into the registry (bypassing
the loader) changes the resolved descriptor from args: ["acp"] to
args: ["--poisoned"], so resolve_effective_harness_descriptor does
reach the registry for this id — it does not short-circuit on the builtin
table first. Two controls discriminate: an empty registry and a registry
poisoned under a different id both return ["acp"]. What actually protects
the test is that the registry has exactly one writer
(update_loaded_harness_registry, reached only via
warm_harness_registry_from_dir) — but that writer concatenates two
sources of unequal strength (custom_harnesses.rs:319-326). Custom files
pass through load_custom_harnesses, whose check_id_collision rejects the
reserved builtin id goose case-insensitively at the loader — and that leg
is tested (load_applies_id_collision_check writes a real goose.json and
asserts the loader drops it). Preset definitions
(preset_harness_definitions, presets.rs:177-193) are a bare .map over
PRESET_HARNESSES with no collision check — exhaustive call-site
enumeration at 60007fda4 finds four production check_id_collision sites,
none on the preset path. That leg holds only because goose is not in the
preset table today (intersection of TIER1 and preset ids is empty) —
executed, not just read: adding a preset with id: "goose",
args: ["--poisoned"] and warming via the normal preset-only path
(warm_harness_registry_from_dir(None), no custom dir, no direct writer)
flips the fixture's emitted launch.args from ["acp"] to ["--poisoned"]
at 60007fda4, command/env/policy_env unchanged. So: no test in the suite
can put a goose entry in the registry
via the custom path, and no preset currently carries one, so no interleaving
can perturb this fixture — containment with one checked leg and one
coincidental one. A future fixture built on a non-builtin runtime id has
no containment at all — it would be order-dependent against whatever
registry-writing test ran last and must take the lock.

Late instance, found while reviewing the mode guard. The guard exact-matches
respond_to untrimmed and case-sensitively, which is only correct if clap's
ValueEnum derive is case-sensitive. config.rs gives two answers: the derive
at :448-453 carries no ignore_case, while the crate's own tests call
RespondTo::from_str(s, true) — ignore_case = true. Reading the source
supports either. Measured on the built binary instead: owner-only starts,
OWNER-ONLY / Owner-Only / ALLOWLIST / NOBODY all exit rc=2 invalid value. Case-sensitive at the CLI, so the guard is right — and right for a
reason the source does not state. The from_str(_, true) tests exercise a
different surface and are not evidence about the CLI.

Corollary, and the sharper half. When a test helper reimplements
production instead of calling it, the helper is a fork — and a fork can be
right while production is wrong, or wrong in the same way, and the suite
reports green either way. Both BUZZ_ACP_ALLOWED_* gates are forked like this:
production compares strings while the helpers compare post-parse enums
(config.rs:2623) or re-derive the split (buzz-cli/.../channels.rs:1296).
Production and the helper each carry their own copy of the empty-entry filter
(:1025 and :1300), so fixing one says nothing about the other. Measured on
buzz-cli, restoring byte-exact between runs:

tree	result
baseline	274 passed
drop the empty-filter in production only (the real fix)	274 passed — no signal
drop it in the test helper only	273 passed, 1 failed (channels.rs:1338)

Two independent defects, stacked, and worse together than either alone:
production can be fixed with no test ever noticing, and the helper cannot be
corrected without a false alarm demanding the bug back. The root cause is one
bit of type information — check_allowed_channel_add_policy(allowed_raw: &str, ..) cannot represent "unset", while production reads env::var(..) -> Result,
where unset and "" are different states. A helper whose parameter type can't
represent all of production's input states isn't testing production's states —
it's testing a subset it silently chose. Same family as the struct-literal
descriptor and the fixture drift: the test and the thing it tests agreeing with
each other, rather than the test measuring the thing. Neither defect is in this
PR's diff (git diff --name-only 28ae6cd21 <head> -- crates/buzz-cli is
empty); both are now filed as NIP-34 issues on this repo: the fail-open +
fork-helper defect at issue event 0524a4113f2d97fd… and the respond-to
self-lock at e32837498969b5e7… (filed 2026-08-02 after Quinn measured that
no prior filing existed — zero hits on GitHub block/buzz open or closed
and zero on the relay's kind:1621 issues, against working positive
controls). The prescription was itself
mutation-tested before being written down: repairing the fork's signature
(Option<&str> + assertion → None) still let the reintroduced production
bug ship 274-green — an expressive fork is still a fork; it never executes
production. So the buzz-cli fix has three parts and one explicit keep:
drop the production filter; delete the helper and point its tests at the
real cmd_set_add_policy (which self-discriminates by error variant —
Usage = refused, Network(BadScheme) = passed the gate — no relay needed);
serialize the env-var tests behind one tokio::sync::Mutex::const_new
lock taken with .lock().await, including the pre-existing :1362
integration test (the fork was silently buying test isolation — without the
lock, parallel runs flake nondeterministically; a std::sync::Mutex held
across .await trips clippy::await_holding_lock under -D warnings); and
keep the then-dead !allowed.is_empty() clause with a comment saying
why. It is unreachable-false (split(',') never yields an empty vec), but it
is the only thing that keeps the reintroduced production bug detectable —
mutation-tested: on a tree that deletes the clause, reintroducing the
empty-filter bug survives 275/0, because ""/","/" " refuse either way
and the filter goes semantically inert. Dead code can be load-bearing for
tests: "provably unreachable" is an argument about behavior, never about
coverage. When a helper forks production, the fix has to delete the fork:
any change that leaves two implementations standing can only ever be
verified against the one the tests call. Final shape: the keep and the
broad lock are both artifacts of the fork surviving in some form. The
extraction variant (Dawn, mutation-tested at 60007fda4) removes the
tension: extract one check_channel_add_policy_allowed(Option<&str>, &str)
that production calls, with the Option placed at the env boundary
where the Result<String, VarError> bit actually lives. 5/6 mutants
killed; the empty-filter survivor is proven equivalent (exhaustive
6174-pair check, 0 divergences, with a diverging negative control;
independently re-derived by a second generator — different tokens and
shape — 0 divergences on admitted policies, 500 on a non-admitted control),
not a coverage hole — on a one-implementation tree there is no fork left to
witness, so no dead clause needs keeping. One scope line on that
equivalence: it is caller-conditional, a property of the only current
caller, not of the gate function — cmd_set_add_policy's own match at
:1027-1034 admits only three policies before the gate runs; a second
caller reaching the gate with arbitrary strings resurrects m1 as a real
hole. The lock does not disappear, it
narrows (Dawn's own correction, caught by Mari): lock exactly the tests
that mutate the process env — three-plus-one on a fork tree, two on the
extraction tree — behind one tokio::sync::Mutex, and the lock is part of
the assertion, not hygiene: with it deleted, the gate test fails 8/8 runs
deterministically by receiving Network(BadScheme) where it expects
Usage — the unset test's remove_var clobbers the other's set_var, and
the gate test passes straight through the gate, a false negative on the
exact authz assertion the test exists to make. State it as an outcome:
these two tests must not observe each other's env writes. 276/0 stable
across 5 parallel runs, clippy -D warnings clean; independently verified
(patch applied to a second worktree: result blob d67e584be matches the
patch index, full mutant matrix reproduces row for row). One new row no
earlier
prescription covered: collapsing unset into Some("") fails closed —
an unconfigured deployment refuses every policy — killed by the unset test.
Patch: OUTBOX/BUZZ_CLI_ADD_POLICY_GATE_EXTRACT_FIX.patch. The filed issue
(0524a411…) carries the fork-shape prescription; whoever picks it up
should prefer the extraction shape, drop the dead-clause keep with it, and
keep part 3 outcome-shaped: serialize whichever tests mutate the env.

Verification (final HEAD 60007fda4)

• Full touched-package suites at each integration merge (log in plan file).
  At candidate parent 00e5b5fe9: buzz-backend-kubernetes 154,
  buzz-acp 673, desktop tauri 2100+3, pnpm 3908, workspace clippy/fmt/tsc
  all clean. The only delta to 60007fda4 is one character in
  scripts/test-k8s-sprig-image-live.sh (heredoc escape so the readlink
  probe evaluates pod-side, not host-side at render); crates/ tree hash
  is byte-identical at both SHAs, so the Rust receipts attach by tree
  identity. buzz-backend-kubernetes suite re-run in-shell at
  HEAD == 60007fda4: 154 passed.
• Adversarial one-HEAD gate (Sami): guard matrix 12/12, predicate mutants
  7/7, doomed-invocation finding closed end-to-end; tree-hash carry to
  60007fda4 confirmed (crates/buzz-backend-kubernetes blob unchanged).
• Live-local pass per TESTING.md + skill-buzz-testing (Perci, at
  60007fda4): explicit docker-desktop context, digest-qualified image
  imported into node containerd k8s.io namespace, pull policy Never;
  pod printed DIGEST_ABI_OK, resolved_spec and image_id both the
  exact requested digest, script exit 0. Dedicated per-run namespace,
  ownership labels on every object, scoped cleanup verified empty after.
• Implementation review (Wren) at 60007fda4: 9.6 minimalness /
  9.4 elegance / 9.3 correctness, no blocker.
• origin/eva/k8s-backend == 60007fda4 (ls-remote verified; SHA
  identity is byte identity).