runner v0.25.0

Runner v0.25.0 puts the Runner's durable state behind a store interface, with the
SQLite store as the shipped kind, an in-memory kind for tests and a conformance
suite that both kinds pass. It also carries the development-kit adoption rows,
the Idempotency-Key boundary tests and the wording change that dropped the
research-preview label. These changes cover the eleven source commits since
published v0.24.0 (#163–#169, #171, #176–#179). Nothing about the SQLite
store's files, statements, schema or lock changed.

What an operator must do

• Nothing new. The boot line's dir is consumed by the SQLite kind only and
  still names the Runner's working directory for Runtime files (releases,
  attempts, runtimes). No other kind can be selected from the boot line.
• The usual care applies before any upgrade: stop Desk and Runner and back up the
  Jobs workspace, including SQLite/WAL, as
  State and backups describes. A store this
  version opens is the same schema the previous version wrote; there is no
  migration.
• Two behaviours are stated rather than changed: a claim of a run, and an end of
  a run at queue time, now require the run to still be queued (with one
  dispatcher under the lock this never refuses), and Close releases the attempts
  directory before the store, with the process lock still released last.

The store behind an interface (#173)

The queue, releases, inputs and run records are reached through one interface in
the Runner's store package: reads (release, job, requested run, entry sequence,
run, oldest queued, entry line, chain page) and writes that go through one
serializable transaction (active runs, create run once per id and per request
key, put run against its expected state, running runs, last entry, create entry,
create release, append journal). Faults are typed: absent, taken, conflict,
durability, unreadable, refused; an error keeps its cause's text. The SQLite kind
is the previous code moved: the same twenty-three statements, a byte-identical
pragma and schema block, the same transactions, opening order, WAL mode and
exclusive process lock. The in-memory kind holds the same semantics for tests.
The conformance suite runs against both kinds: a release created once; a run
queued once by id and by request key; queue order; a queued run claimed once with
a stale claim refused; concurrent producers and claimers retrying on conflict;
a failed transaction keeping nothing; a failed commit reported as a durability
fault; one chain entry per run read in order; absent and unreadable typing; and,
for SQLite only, a reopened store holding what it held and a second process
refused by the lock. The unit-test step fails unless both kinds passed. See
the store interface. Triggers, occurrences, job
creation and revision, briefs, workflows, manual admission, metadata, the
listings and the journal's reads stay on the SQLite handle; the design note lists
each.

Development kit and tests (#163–#169, #176–#178)

The repository runs the development kit's vendored checks (scripts/dev/check.sh
at kit v0.9.0 with the changed-path selection); a pull request runs the checks
its changed paths map to and a push to main runs the whole list, which alone is
release evidence. The Idempotency-Key ASCII and length boundaries are covered by
tests (#168). The README and the security policy no longer call the Runner a
research preview (#171).

Source evidence and pending release gates

• Runner native Linux/macOS CI
  40363510184
  passed at 387b8b2b93e6b699ceea009323ccd645d166da5d (the reviewed store-interface change
  on top of main), including the release-contents job. The review record and
  its disposition table are on
  pull request #179: no HIGH or MEDIUM
  finding; the two stated behaviours above were traced as unobservable today;
  the twenty-three statements, the schema block and the transaction boundaries
  were compared on both sides; probes on both kinds (duplicate ids and request
  keys, stale claims, racing claimers, a real commit failure, a killed holder of
  a claimed run, chain order) and sixteen mutants all held.
• The push-triggered whole-list run on main at the merge commit is the
  evidence the release takes.

Tag-time CI, the packaged archives, checksums, attestations, native archive smoke
and draft/publication verification for v0.25.0 remain pending under
the release procedure. No Windows archive is released.