feat(authoring): bind public tools to frozen source provisioning

[777genius]

Public authoring controllers previously had no independently provisioned tool authority. This change binds controller selection to a source-frozen manifest instead of receipt-selected executables, with matching JavaScript and Python validation, source/tool rechecks and sanitized child environments.

The manifest defines six controllers and eighteen execution cells. Unprovisioned fields are explicitly null. Full public execution remains closed until the remaining C3b producer, scenario validation and evidence integration are implemented; this PR does not establish authentic E2E or release readiness.

Validation on ade405f:

• Writer: 6 Node and 26 Python tests passed with no skips; all 20 pre-existing Python tests retained.
• Seventeen identical decoder fixtures agreed across JavaScript and Python.
• All 3,377 unowned original tracked files preserved. Patch, source hashes and modes independently checked during mechanical integration.
• Initial independent hosted Astra low review found two defects: empty closure members were rejected, and Unicode path bounds differed between JS and Python. Both were corrected with regressions. The first CI also exposed a read-induced atime false positive; the fix excludes only atime from identity comparison and retains mutation checks. Follow-up independent hosted Astra low review ACCEPTED exact ade405f, with 6 Node and 26 Python tests passing and an independent atime diagnostic. Artifact checksums and unchanged source were verified. All ten exact-head CI checks pass, including Windows smoke and the previously failing aggregate check.

Size: 919 additions and 19 deletions across seven paths, including 266 manifest data lines; 672 handwritten changed lines. YAML functionality remains preserved.

Stacked on #216. Related acceptance work: #232 and #208. Full implementation and authentic platform qualification remain tracked by the original authoring plan.

Refs #216, #232, #208.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}