feat(yaml): release-ready yaml engine v2

[caballeto]

Summary

Brings the v2 declarative YAML engine to release readiness — full resource
coverage (status pages + branding + components/groups, monitors, alert
channels, notification policies, resource groups, environments, secrets,
tags, dependencies), parity with the Terraform provider's BDD scenario
matrix, and zero phantom drift on a clean re-plan.

What landed

Schema / transform / handlers

• Removed PASSWORD and IP_RESTRICTED visibility from the public surface (not GA).
• Default requireAck=false and assertion severity=fail outbound so we match API persistence.
• stripNullish snapshot helper aligns alert-channel configHash and every monitor/policy snapshot with the API's canonical form — kills phantom drift from API-echoed nulls.

Engine semantics

• hasChildChanges on the handler interface lets the differ queue an update when only nested children differ (e.g. a new status-page component on a byte-identical page).
• Pending-ref placeholders (registerYamlPendingRefs + isPending on RefEntry) let existing resources resolve refs to brand-new peers during snapshot computation. Differ ignores pending entries when deciding create vs update; resolver swaps placeholders for real IDs after create.
• RESOURCE_ORDER reordered so monitors create before notification policies (policy matchRules can reference monitor IDs).

Other

• ESM fix in lib/resources.ts (require('node:fs') → top-level import) so --branding-file works in the ESM runtime — caught by surface tests.
• Status-page imperative subcommands tightened (components/groups/domains/incidents/subscribers list + create/update on components).

Test coverage

• Unit: 575 / 575 passing across 18 files (transform, handlers, differ, resolver, state, child-reconciler, interpolation, moved, validator, zod-schemas, idempotency).
• Surface: 150 / 150 passing in mono/tests/surfaces/cli/ (status pages + branding + components/groups + YAML engine).
• BDD: 40 / 40 passing across 7 tiers (Quickstart, Org Structure, Evolution, Migration, Full Composition, User Mistakes) — mirrored from the TF provider where applicable.
• All xfail markers from earlier rollout removed; underlying bugs fixed and unit assertions inverted to the correct expectation.

Cross-repo dependency ⚠️

This PR depends on matching changes in devhelmhq/mono that must land first (or together):

1. API monitor list-endpoint enrichment (assertions, auth, policies, channel IDs, env summary) via batch queries in MonitorServiceImpl.enrichPageFully.
2. API alert-channel canonicalConfigHash null-stripping so it matches the CLI's stripNullish + stableStringify + sha256Hex.
3. API resource-group list endpoint populates members[] with name/slug.
4. New CLI surface + BDD tests under tests/surfaces/cli/ (the mono surface-integration-test workflow runs them against the released CLI tag).

Without (1–3) the CLI will report phantom drift on every plan in production. Without (4) the mono surface-integration job for the release tag will fail to find the new tests.

Test plan

• npm run lint clean
• npm run typecheck clean
• npm test — 575 / 575
• npm run build produces oclif manifest cleanly
• Surface tests (mono): 150 / 150
• BDD tests (mono): 40 / 40
• Reviewer: confirm mono companion PR is merged before tagging the release

Made with Cursor