feat(package-service): add private package state model (#1750) - #1800

Linked Issue

Tracking #1750

Summary

Repairs the private registry-neutral package-service contract and pure owner/package state model at the rejected exact head.

This slice adds no package parsing, transport, durable persistence engine, execution wiring, or external authority mapping. It does not close #1750.

Changes

• Drain commits now enforce the authoritative drain deadline even after accepted zero-lease proofs, so a late commit with a valid receipt can no longer complete a replacement or retirement after the drain window closes.
• Drain proofs fail closed at the exclusive authority expiry, including when the drain deadline and expiry coincide.
• Unknown non-drain operations on an absent slot reach a conservative terminal outcome during recovery instead of remaining unresolved.
• Unknown records reported before a drain starts, and executing records left past the drain deadline, terminate safely without fencing the slot.
• Admitted intents left past their authority expiry reach a safe terminal outcome, releasing the nonce and slot.
• Generation exhaustion is preflighted at admission and drain start, and proof advancement refuses boundaries that could never commit or restore.
• Work past a closed drain deadline fails closed at begin_work, and the artifact budget is rechecked at commit.
• Package-service test fixtures derive nonce and signing material instead of embedding hard-coded cryptographic values.

Repair Law

• Validate artifact budgets before first admission and at plan validation.
• Reject Exact zero state so it cannot substitute for absence.
• Bind authority class into the signed payload and retain the admitting authority for cancel and recovery.
• Reject stale authority admission without creating a durable nonce.
• Bind commit and drain runtime receipts exactly and enforce the drain deadline after accepted proofs.
• Restore expiry and old-state recovery as the exact inactive successor of the authoritative drain boundary, advancing generation.
• Recover zero-, one-, and many-proof old-state outcomes and explicit non-drain unknowns.
• Name plan/operation conflicts and state that nonce replay protection lasts only through retained bounded history.
• Use canonical OwnerId encoding and conservative durable-record accounting.

Verification

• cargo test -p astrid-package-service --all-features --all-targets --locked
• cargo check --workspace --all-features --all-targets --locked
• cargo clippy --workspace --all-features --all-targets --locked -- -D warnings
• cargo fmt --all --check
• git diff --check
• python3 scripts/changelog.py check --base b868d0a770704fbca262e27ed2e6bd08c9ec5133 --head HEAD
• GPG commit verification and DCO author match

AI / Tool Assistance

Assisted-by: Codex

Codex drafted the successor repair, tests, changelog update, and workspace evidence. Independent review remains required.

Checklist

• Linked to an issue
• Changelog fragment updated under changes/{issue}.{kind}.md
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.