Track target adapter ownership by digest

[levifig]

Summary

• Emit strict, versioned .loaf-target-manifest.json files for Claude Code, Cursor, Codex, OpenCode, and Amp build outputs, recording each managed artifact's destination, kind, mode, and SHA-256 digest.
• Reconcile target adapters from those manifests during install, upgrade, and removal, with schema and path validation, symlink refusal, collision and drift checks, atomic replacement, and rollback on partial failure.
• Preserve legacy target behavior when no manifest exists, add adversarial ownership and rollback coverage, and regenerate the native binaries and capability receipts from the final source.

Why

Target-adapter ownership was implicit and target-specific. Installers could not consistently distinguish Loaf-owned generated content from foreign, modified, or stale files. Content-addressed manifests give each build a deterministic ownership contract so installation converges safely and refuses ambiguous or tampered state.

User impact

Install and upgrade operations can now prove which adapter artifacts belong to the current Loaf build before replacing or removing them. Foreign content, digest drift, mode drift, path escapes, symlinked destinations, and concurrent changes fail closed instead of being overwritten.

Validation

• LOAF_VALIDATE_TYPESCRIPT=1 npm run build
• npm run test
• npm run typecheck
• go vet ./...
• go test ./internal/cli/ -run 'TargetAdapter|AdapterManifest|TestRunnerBuildRunsContentBuilderNatively|TestTargetCapabilityAdapters'
• Executable Change check
• render-drift, ephemeral-provenance, check-secrets, validate-commit, and security-audit
• Independent digest/mode verification across all five generated manifests
• Independent Claude Fable 5 xhigh review: APPROVE, with no high- or medium-severity findings

A redundant cache-cold go test ./internal/... -count=1 started by the reviewer was stopped after more than ten minutes of buffered silence; it produced no failure output and is not counted as a passing validation above.

Non-blocking review observations

These low-severity observations are preserved for follow-up and do not block this change:

1. Cursor projection hashing uses lenient json.Unmarshal, while Codex uses the strict loader (internal/cli/build_manifest.go:240,300-324).
2. decodeCodexHooksBodyStrict round-trips through a temporary file to reuse the file-based strict loader during read-only ownership inspection (internal/cli/build_manifest.go:300-324).
3. Generated target manifests are exempt from the unresolved-token and forbidden-term build lints (internal/cli/build.go:417-419).
4. Codex removal retains empty event arrays and drops legacy version metadata, while Cursor removes empty arrays; this is content-safe shape drift (internal/cli/build_manifest.go:978-982,1009; internal/cli/install_target.go:117).
5. A hypothetical Amp plugin artifact whose destination is not plugins/loaf.ts would fall through beneath AmpPluginsDir; generated manifests cannot currently reach this path, and collision rechecks still protect it (internal/cli/build_manifest.go:708-717).