Make delivery control programmable

[bigboateng]

Summary

• compile CoreSystem, one explicit PrimaryFlow, and optional conservative extensions into one immutable, fingerprinted ControlProgram
• keep Kernel responsible only for observe, resolve, admit, effect, verify, receipt, and recovery mechanics
• preserve the shipped StandardFlow behavior as a 30-transition flow over the 32-transition CoreSystem
• add repository-scoped in-process and checksum-bound subprocess extensions without mutable global program state
• remove the fixed transition catalog, old reducer package, and the pre-replacement Kernel construction surface

Contracts

• Standard distribution: 32 CoreSystem + 30 StandardFlow + 0 default extensions = 62 transitions
• Reference extension distribution: 63 transitions
• program fingerprints bind component identities, exact manifests, transition bytes, ownership, recovery, goal contracts, settings, and extension executable identities
• admissions, journals, receipts, snapshots, recovery, and re-resolution preserve the exact program fingerprint
• subprocess response payloads are strict tagged unions; executable identity is reverified before every invocation; output overflow cancels the child and fails closed

Verification

• release-note validation
• 26 Python repository and detached integration tests
• all 129 Go tests across 10 isolated shards
• go test -race ./...
• go vet ./...
• go build ./...
• six release-platform cross-builds
• git diff --check