feat(fleet): module-owned publisher lineage; reject expressions in Dagger args

[hseshadr]

TL;DR

Two fleet-policy security gaps from #49, closed in the central module instead of in consumer shell.

1. Publisher lineage is now a module function. portfolio-foundation gains release-lineage (PyPI) and release-provenance (npm). Each fails unless GitHub's run records show all of the following: the candidate run is a successful release-candidate.yml dispatch for exactly HEAD_SHA; the publish run is this repo's in-progress publish.yml workflow_run on main; and main contains both commits (branches/main endpoint, so a tag named main can't stand in for the branch). release-provenance also returns npm's github-context.json, built from the publish run record instead of caller text. The fleet policy accepts exactly this leading step (publisher-lineage for anything weaker) and a consumer publisher loaded at @${{ github.sha }}. edgeproc-core and privacy-core can then drop their run: steps with no exemption.
2. dagger-args-expression. The policy now rejects ${{ inputs.* }}, ${{ github.event.* }} and ${{ github.head_ref }} in every dagger-for-github input the action pastes into bash (args, call, shell, dagger-flags, workdir, cloud-token). module is exempt because the action passes it as INPUT_MODULE env.

Claim touched: "a publisher only ships bytes built from main" and "no caller-controlled text reaches script".

Fixes #49

Merge order

This PR is stacked on #47 (feat/fleet-minimum-pin) and #48 (feat/fleet-coverage). Merge it after both. Its base is main, so until they merge, the diff also shows their commits.

Contract reversal (read this)

NPM_BRIDGE and the planned-PyPI fixture in test_fleet_policy.py pasted --expected-sha=${{ github.event.workflow_run.head_sha }} into args and asserted that shape was compliant. They now pass it through env: as --expected-sha="$HEAD_SHA". The policy reports the old shape.

Fleet impact after merge (new dagger-args-expression findings on current mains)

Repo	Where	Fix
assay	release-candidate.yml (inputs.tag), publish.yml x2 (workflow_run.head_sha)	hseshadr/assay#74
almamesh	deploy.yml (workflow_run.head_sha, .id, .run_attempt)	needs env migration
edge-reco	deploy.yml (same three)	needs env migration
aml-filter	deploy.yml, publish-watchlist.yml (github.event.workflow_run.head_sha)	needs env migration
agentic-saga	dagger.yml, dagger-security.yml (github.event.repository.private inside a conditional)	needs env migration

These values are GitHub-generated, but the rule is literal by design. It flags every event expression, with no judgement about which ones are safe.

Evidence

Check	Result
New policy tests, before the change	red: 16 failed / 14 passed (every expression case, and both lineage shapes reported pypi-shape/npm-shape)
Root poe gate (lint, mypy, xenon A, pytest, branch floor)	green: 275 passed, 97% line coverage
portfolio-foundation lineage tests	31 passed. lint, mypy strict, xenon A green
Mutation M1: expression guard disabled	14 failed
Mutation M2: lineage env binding (RUN_ID/HEAD_SHA from the event) dropped	2 failed
Mutation M3: ancestry (compare) check dropped	3 failed (both tag-named-main cases + publisher-not-on-main)
Mutation M4: candidate SHA binding dropped	3 failed
Live, through the engine from this branch (at 49b2716; later commit 3de1c4b only splits helpers): dagger -m .../portfolio-foundation@3de1c4b functions	release-lineage, release-provenance listed
Live release-lineage on privacy-core run 35935478810 + completed publish run	candidate accepted from the real payload; refused at "publish run is not this repository's running main publisher" (fails closed: the run is not in progress)
Live release-lineage on failed candidate run 35930137724	refused: "candidate run is not a successful release dispatch of this SHA"
Live compare via the module's REST adapter	released SHA de1c0b8 contained in main; privacy-core#48 PR-head 8de4231 refused "not contained in main"

Not verified

• The success path end to end. It needs a real in-progress publish run, which only a tag dispatch creates, and this PR dispatches nothing.
• The full portfolio-foundation poe gate locally. On this machine it stops at 86% total coverage even on the base branch, before this change (247 passed, 1 skipped). ci's hosted CI does not run module gates.
• Not enforced yet: the lineage step is accepted, not required. edge-proc and assay publishers still pass without it. Requiring it is a follow-up once they migrate.

Consumer drafts pinned at this PR's head: hseshadr/edgeproc-core#60 and hseshadr/privacy-core#49; assay injection fix: hseshadr/assay#74. They get re-pinned to the merge SHA after this merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a