[U31] Apply and resume provider changes against failure-injection fakes

[ZempTime]

PRD: #1
Delivery unit: U31
Campaign: C09
Canonical graph: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/2026-07-20-delivery-plan.md
Common unit contract: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/UNIT-CONTRACT.md

• Acceptance umbrella / blockers: GitHub Provision the reference stack from credentials only #13; blocked by U04 and U28.
• Outcome: The provisioner validates least-privilege capabilities and idempotently creates/updates only manifest-declared, namespaced Northflank, PlanetScale, R2, and DNS/TLS resources against provider command/API fakes, with resumable checkpoints.
• Failure/recovery: Unknown existing resources, partial creation, provider timeout/rate/error, stale plan, scope deficiency, plan-cost change, retry, and rollback never adopt/delete unknown resources, upgrade plans, buy/transfer domains, or accept terms.
• Evidence: Provider command-contract and failure-injection matrices, exact inventory/state transitions, idempotent apply/resume replay, redacted errors, and infrastructure/security review.
• Central surfaces / impact: Provider adapters, manifest state, resource naming, checkpoint store, deployment docs. Use current official provider APIs at implementation time; no live credentials.
• Safe split: One provider adapter may checkpoint after the shared manifest/apply protocol is green, but later providers must implement the same public state machine rather than fork it.

Every integration records a factory candidate with evidence or No reusable harvest.