feat(zeroshot-rust): compile secret-free native manifests and worker bindings

[tomdps]

Parent

• feat(zeroshot-rust): parse isolated native configuration and named profiles #689 — feat(zeroshot-rust): add native config, binding references, and credential resolution

Execution

AFK. Start only after every issue in Blocked by is merged, required CI is green for the resulting dev SHA, and the worktree is created from a freshly fetched origin/dev.

Outcome

Compile typed provider/profile selections and role contracts into one bounded secret-free admission manifest, immutable worker registry snapshot, and runtime binding references.

Authoritative contracts/current state

#670 owns provider metadata and #768 owns role contracts. #753 supplies the generic built-in descriptor profile. Merged #669 owns opaque runtime binding carriers; this issue composes them without importing concrete drivers.

Owned scope

• Define the complete versioned admission manifest: provider/profile/catalog/role/worker descriptor digests, model/reasoning/session policy, workspace/source/proof policy references, deadlines, and no secret values.
• Construct an immutable WorkerRegistry snapshot and compile every agent/built-in WorkerRef to exact WorkerBindingRef/DriverFamilyId data.
• Perform the exhaustive DriverFamily match against injected abstract driver slots/fakes; concrete CLI/ACP/Gateway types remain outside the compiler.
• Validate all cross-field compatibility, deterministic ordering/digests, bounds, and graph-worker closure before admission.

Acceptance criteria

• Equal inputs produce byte-identical manifest/registry/bindings; any policy/catalog/role change changes the digest.
• Unknown/missing/ambiguous provider, worker, role, built-in, model, scope, or driver slot fails with a safe bounded error.
• Manifests contain no credentials, environment values, paths, endpoints, runtime handles, or arbitrary JSON.
• ProductionGraphVerifier can consume the snapshot unchanged and no second registry/binding algebra is introduced.

Verification

cargo test -p zeroshot-rust --test admission_manifest
cargo test -p zeroshot-rust --test worker_bindings
cargo test -p zeroshot-rust --test architecture
npm run rust:check
npm run protocol:check
npm run typecheck
npm run lint
npm run test:unit
opcore check --changed

Every named focused target is an issue-owned deliverable and must execute non-zero tests before the common gates.

Non-goals

• Filesystem settings precedence or credential acquisition.
• Concrete driver implementation.
• Graph workflow topology or protocol descriptor semantics.

Blocked by

• feat(zeroshot-rust): own the versioned worker-provider catalog #670 — feat(zeroshot-rust): own the versioned worker-provider catalog
• feat(zeroshot-rust): define the versioned native role-contract pack #768 — feat(zeroshot-rust): define the versioned native role-contract pack
• feat(cluster-protocol): add the deterministic built-in worker binding profile #753 — feat(cluster-protocol): add the deterministic built-in worker binding profile

Unblocks

• feat(zeroshot-rust): resolve native credentials into ephemeral capabilities #770 — feat(zeroshot-rust): resolve native credentials into ephemeral capabilities
• feat(zeroshot-rust): compile built-in workflows to full-v1 graphs #676 — feat(zeroshot-rust): compile built-in workflows to full-v1 graphs
• feat(zeroshot-rust): implement native plan/apply/get admission #697 — feat(zeroshot-rust): implement native plan/apply/get admission