Add offline progressive whole-attempt controller core

[DecisionNerd]

Closes #1034
Parent: #900

Summary

Adds the provider-free Python core for one sequential S18→S26 qualification attempt while keeping the live progressive-ladder operator gate fail-closed.

• requires a schema-valid, commit-bound S18/S19 prefix;
• validates a closed Pulumi ESC-oriented spend authorization with positive integer micro-USD rates, a five-hour maximum, and an end-to-end deadline;
• hash-binds the first admitted plan before any provider mutation;
• advances S20→S22→S24→S25→S26 one rung at a time through an injected transport;
• binds execution and result evidence to the provider-observed immutable image;
• retrieves the result first and accepts only the canonical five-file hash-bound bundle;
• persists an fsync-backed ownership/progress ledger;
• rolls back partial evidence publication and supports idempotent cleanup-only recovery;
• verifies independently empty teardown inventory and retains typed recovery state on cleanup failure.

No real provider transport is implemented or enabled here. No provider calls or spend occurred.

Verification

• make -C benchmarks progressive-provider-attempt-static — 20 passed
• full benchmark unittest discovery — 149 passed
• Ruff — clean
• progressive schemas — Draft 2020-12 meta-valid
• workflow checker — passed
• gate registry — 23 workflows valid
• three independent final audits — clean

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b39280db-6876-4a32-965c-4def8bf68573

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{Comment @coderabbitai help to get the list of available commands.}