Dual-write provider-target rows on target identity mutations

[cbusillo]

Intent

Make every Launchplane-owned target identity mutation write the explicit ProviderTargetRecord row alongside existing Dokploy target/id records.

Current Status

Waiting for audit slice #1101 to establish drift visibility. Parent: #1100.

Finish Line

Product onboarding, Dokploy adoption/creation, Odoo target replacement, and other target identity mutation paths either write the matching provider-target row or fail closed with a clear mismatch.

Acceptance Criteria

• Product onboarding writes provider-target, Dokploy target, and Dokploy target-id records for provider_targets manifests.
• Dokploy adoption/creation writes provider-target rows after target id/type are known.
• Target mutation paths block conflicting existing provider-target rows instead of overwriting silently.
• Dual-write errors surface; no silent compatibility fallback.
• Tests cover success, mismatch, partial write prevention, idempotency, and compatibility output preservation.
• Docs keep Dokploy execution config ownership explicit while moving identity writes to provider-target records.

Quality Gates

Targeted onboarding/adoption/Odoo mutation/storage tests, then uv run python -m unittest, changed-file ruff, and mypy for touched control-plane/test modules.

[cbusillo]

Completed in PR #1108 and merged to main at f47ca59.\n\nValidation:\n- PR CI passed: https://github.com/cbusillo/launchplane/actions/runs/26819395175\n- PR Security passed: https://github.com/cbusillo/launchplane/actions/runs/26819395112\n- PR CodeQL passed: https://github.com/cbusillo/launchplane/actions/runs/26819395156\n- Main CI passed: https://github.com/cbusillo/launchplane/actions/runs/26819610274\n- Main Security passed: https://github.com/cbusillo/launchplane/actions/runs/26819610383\n- Main CodeQL passed: https://github.com/cbusillo/launchplane/actions/runs/26819610241\n- Deploy Launchplane passed: https://github.com/cbusillo/launchplane/actions/runs/26819736793\n- Live health OK: trace launchplane_req_0e3b7ed53ef64ce699a92001f61a0a61, storage_backend=postgres\n\nNotes:\n- Product onboarding, Dokploy target adoption/create, product context cutover, and tracked Dokploy metadata commands now dual-write explicit provider-target rows from complete Dokploy target/id pairs.\n- Stale physical provider-target conflicts block before writes where the mutation can be preflighted; create-application also blocks before live Dokploy mutation when a physical row already occupies the route.\n- Odoo target replacement was inspected and left unchanged because it deploys against existing target identity rather than mutating stored target id/type.

[cbusillo]

Closing #1102 after PR #1108 merge, green post-merge gates, successful deploy, and live health verification.