test(coven): pin the daemon canary to v0.4.9 and require the run-control actions

[BunsDev]

Refs #80, OpenCoven/coven#1054.

Summary

This re-pins the Automations v1 daemon canary from @opencoven/cli@0.4.8 to the published Coven v0.4.9. It also requires the daemon to advertise the five run-control commands that v0.4.9 implements (OpenCoven/coven#1218, OpenCoven/coven#1219, OpenCoven/coven#1220 and OpenCoven/coven#1221):

• coven.automations.occurrence.runNow.v1
• coven.automations.occurrence.cancel.v1
• coven.automations.attempt.cancel.v1
• coven.automations.attempt.retry.v1
• coven.automations.occurrence.recover.v1

The canary checks that the daemon advertises these commands. It does not exercise them, for two reasons:

1. The SDK does not send them. They are Phase 3 of P1: Add constrained Coven Automations SDK types, subscriptions, verification, and authority-aware commands #80, which waits for P0: Bind automation runs to principal authority, familiar revisions, capabilities, approvals, and receipts coven#857 and P0: Build automations conformance, chaos, SLO, and operator diagnostics coven#858, and the command transport in packages/coven/src/automations-commands.ts accepts only the definition commands.
2. The canary runs no occurrence. Its schedule is twelve hours away, so there is nothing to cancel, retry or recover.

Changes

• conformance/automations-v1-daemon/: @opencoven/cli is 0.4.9. The regenerated lockfile covers cli, cli-macos, cli-macos-x64, cli-linux-x64 and cli-windows. Each sha512 integrity matches npm view @opencoven/<package>@0.4.9 dist.integrity.
• .github/workflows/ci.yml: the step is now "Drive the released Coven v0.4.9 daemon through the SDK", with --expect-version 0.4.9.
• scripts/verify-automations-v1-daemon.mjs: the five actions join requiredActions, with a comment explaining why they are advertised but not sent.
• tests/automations-v1-daemon-canary.spec.ts: the in-memory daemon advertises the five actions. Five new cases fail closed when any one of them is missing. The suite has 35 tests.
• README.md, docs/ROADMAP.md: these describe the pin and the new requirement, and state that the commands are advertised, not exercised.

Validation

• Targeted tests cover the changed behavior. With the five removed from requiredActions, exactly the five new cases fail (5 failed, 30 passed).
• corepack pnpm@10.34.0 verify passes. I did not run the full suite locally, because the machine had under 1 GB of free disk. CI runs it.
• Public behavior changes include a Changeset. None is needed: only tests, CI and docs change.
• Documentation and contract fixtures are updated where needed. The contract fixtures are unchanged (see Release impact).
• No credentials, private endpoints, or sensitive error causes are included.

I ran these locally:

• The CI step against the published 0.4.9: npm ci from the new lockfile, then npm audit signatures ("2 packages have verified registry signatures", "2 packages have verified attestations"), then the canary:

  Automations v1 daemon verified: covenVersion=0.4.9 daemonStarts=2 commands=9 replays=2 rejections=2 events=5 subscribePages=2 definitionIntegrity=matches-sdk adoptionReplayAcrossRestart=passed checkpointResumeAcrossRestart=passed eventDefinitionDigest=matches-definition-integrity peerIdentity=harness-asserted
  

• Against the published 0.4.8, the canary now fails as intended:

  Automations v1 daemon canary failed: capabilities: missing coven.automations.occurrence.runNow.v1, coven.automations.occurrence.cancel.v1, coven.automations.attempt.cancel.v1, coven.automations.attempt.retry.v1, coven.automations.occurrence.recover.v1.
  

• Unit, lint and types: the canary spec passes 35/35, including the pin test that ties the lockfile, package.json and the workflow together. eslint --max-warnings=0 is clean on both changed code files, and pnpm typecheck passes.

Release impact

None for published packages. Only tests, CI and docs change.

The base-artifact lock (conformance/automations-v1-artifact-lock.json) still names the v0.4.7 producer, with contract content ef266d16. v0.4.9 ships contract content 528b900c. Re-pinning it means new producer run, artifact and manifest values, and possibly regenerated contract fixtures. It is a separate follow-up, as #337 was separate from #339.

✨ Co-authored by Cody, a Coven familiar for Val