feat(resilience): prove provider access rollback

[robinbraemer]

Outcome

Adds an Effect-native, fail-closed provider-access rollout verdict and executes the Kubernetes failed-upgrade/rollback path in the disposable Fleet.

• acknowledges a provider release only when AgentGateway, authorizer, adapter, policy/profile/ceiling, credential, and budget revisions are exact and Ready
• requires rollback and restore targets to be previously verified release digests
• proves a two-replica zero-unavailable workload withholds an unready revision, preserves serving replicas, rolls back through native history, and later completes a good upgrade
• upgrades the owned AgentOS CloudNativePG topology from one instance/no backup policy to three instances with separate WAL storage and standby-preferred online VolumeSnapshot backup
• makes the retained-state AI Gateway singleton an explicit OnDelete operation and adds revision history/topology spread to the GitHub broker
• documents install, upgrade, rollback, backup/restore, adapter compromise, kill switch, and direct-provider break-glass operations without exposing credentials or blocking ordinary Internet

Verification

• mise exec http:bun -- bun run check
• 163 files / 774 core tests passed
• Effect migration policy: 509 TypeScript paths, zero violations
• all affected Kustomize trees rendered successfully
• disposable Kind access/rollout proof: 2 tests passed in 45.41s
• bad revision withheld; v1 rollback and v2 upgrade observed; unrelated Service reachability preserved
• disposable cluster deleted; no Kind clusters remained; context restored to orbstack
• git diff --check

Advances #96. Backup/restore and compromise drills remain before closing the issue.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	agentos-site	7fc475a	Commit Preview URL Branch Preview URL	Aug 03 2026, 07:50 PM