[SaladDay]

Runtime allocations, placement, compute suspension, observation, lifecycle nodes and credential allocations move out of store into deployment, deployment/placement, deploymentpg and placementpg. This completes PR 3; #332 moved reset and address bindings.

What changes

• deployment/placement holds the pure placement and admission rules: public origin, creation admission, placement, reservation and restore checks, and the loopback origin.
  • placement.NewRules(declarations, publicURL) is built once in cmd/server from the provider registry and the public URL. Neither changes while Core runs.
  • deployment/placement imports neither sessions nor deployment, and does no I/O.
  • Only deployment interprets provider declarations.
• deployment:
  • lease-bound ExecutionOperations: reserve, ObserveRunning, Keep, SettleCreation, Release, RequestCleanup, ReleaseAbsentCreation, SetCompute, RecordObservation and ClearWake;
  • Service: TouchActivity, LifecycleNode and AllocationGeneration;
  • Reader reads for allocations, credential allocations, observation, nodes and lifecycle scheduling.
• deploymentpg:
  • Each allocation write is one leased transaction: load, lock the Session, apply, sessionpg.PruneChanges. A prune failure aborts it.
  • Allocation cleanup is one leased transaction that embeds *sessionpg.SessionTx. It calls sessions.CancelWork or sessions.TerminateEnvironment with the same event order and rollback as before.
• placementpg holds only fact loads and reservation applies on transaction-bound queries. deploymentpg, sessionpg and Session creation call it inside their own transactions. The compute-admission fact now has its one home there.
• Lease-pinged reads: the scheduling and discovery reads that pinged the lease are plain Reader reads. Every provider effect is still preceded by a lease ownership check or a lease-fenced write. ClearWake is a leased write.
• Removed from store:
  • the ten runtime allocation, placement, node, observation, suspension and credential-allocation files;
  • public_url.go, together with SetPublicURL;
  • environment_connections.go;
  • checkExecutionOwnership;
  • two test-only reads and their query.
• Generated output: sqlc and OpenAPI are regenerated. The schema store.RuntimeNodeAllocation is renamed deployment.NodeAllocation with the same wire shape.
• Docs: IMPLEMENTATION.md names the new owners and participants.

Behavior

• Allocation writes:
  • Conflicts are deployment.ErrAllocationConflict.
  • Malformed input, including a bad credential digest, is deployment.ErrInvalidInput.
  • Paths that reach the public API keep sessions.ErrNotFound for the same 404, until handlers route to their own error mapper.
• Creation admission: it returns placement.ErrAdmissionClosed, which maps to the same 409 environment_unavailable.
• Allocation write transactions: the allocation pre-read and owner check now run inside the leased transaction.
• TouchActivity: it is a pooled write that only bumps the idle clock.
• Unchanged: HTTP statuses, codes, persisted rows and event sequences.

Checks

• go build ./..., go vet ./services/core/..., make sqlc-generate and make openapi (no further diff), and scripts/check-names.py.
• deployment/..., deploymentpg, placementpg and sessionpg in full. The deploymentpg PostgreSQL tests cover:
  • concurrent reservation;
  • the lease requirement on every allocation write;
  • cleanup rollback;
  • prune-failure rollback.
• store -run over:
  • every test in the store test files this PR touches;
  • the hosted-creation, managed, placement and allocation tests;
  • every test that builds a Store directly;
  • the official-SDK and environment-key tests, run with their dependencies installed.
• api and cmd/server in full; execution and storeresolver -run on the runtime lifecycle, compute, observation, wake and allocation tests.

The blind review found no blockers or majors, and confirmed that no Worker that lost its lease can issue a provider effect it couldn't issue before. Its four minor findings are fixed in this commit:

• dead store helpers;
• a process-history test name;
• the error identity of a bad credential digest;
• the cleanup-order and prune-rollback tests.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}