Add trusted attachment staging and signed native worker binding

[dovvnloading]

Summary

This stage completes the next planned Phase 2 slice: trusted attachment staging and per-job signed/native worker-attempt composition.

What changed

• Added ArtifactBoundary.stage_bytes so already-bounded attachment bytes use the same owner, size, MIME, digest, retention, and atomic-publication controls as trusted path copy-in.
• Added durable, idempotent attachment.stage.v1 staging with:
  • owner/request idempotency and conflict detection;
  • active/archive/executable rejection through byte-derived MIME sniffing;
  • bounded retention and byte limits;
  • terminal artifact revalidation on retries;
  • path/payload exclusion from durable records and API responses.
• Added qualification-only POST /api/v1/execution/attachments and generated OpenAPI/TypeScript contracts.
• Added NativeRecipeWorkerAttemptFactory and build_native_recipe_coordinator_factory:
  • fresh broker binder, protected pipe identity, launcher, AppContainer worker, and authenticated client per job;
  • signed installer and explicit reviewed process-factory injection;
  • broker PID/principal/job binding before resume;
  • bounded broker accept and worker-client timeouts;
  • deterministic cleanup for launch, accept, cancellation, and timeout failures;
  • no host-process, subprocess, or alternate-transport fallback.
• Added focused adversarial tests and updated the Phase 2 ADR/evidence trail.
• Added the frontend API client method without enabling the feature in the UI or normal app lifecycle.

Safety and rollout

The normal Cortex application remains default-off. Both routes require a ready explicit qualification lifecycle. Configuration creates no process; an absent signed package, broker binding, or reviewed native process factory remains blocked.

Verification

• Python: 340 passed, 1 expected native-platform skip
• Frontend: lint passed; typecheck passed; 41 tests passed; production build passed
• compileall, contract generation, and git diff --check: passed

Next gate

The next planned stage is an end-to-end durable-coordinator qualification run through the packaged signed worker, covering staged transform, in-flight cancellation, retention, atomic publication, owner isolation, and complete native cleanup. Production signing/trust and external review remain optional official-release hardening.