Fix upstream sync reliability controls

[bigboateng]

What changed

• add real Windows interlock upgrade support using a detached replacement helper, checksum verification, backup/rollback boundary, and completion reporting
• add Windows-aware upgrade E2E coverage and fail-closed checksum tests
• move sync PR merge intent to native GitHub auto-merge under the publisher App
• refuse auto-merge unless main has required status-check protection
• automatically migrate legacy ownership manifests only when every projected hash is equivalent
• regenerate the Boatstack, Value Map, Pitot, and Interlock control-plane workflows

Root cause

Interlock sync PRs #25–#27 failed because the new upgrade E2E executed an extensionless interlock path on Windows while the product explicitly rejected Windows self-upgrade. Separate fleet inspection found Value Map workflow permission drift, Pitot legacy-manifest ownership drift, and no active main branch protection in any of the four downstream repositories.

Control law

The publisher App proposes and authenticates change; platform E2E tests prove shipped behavior; branch protection decides merge eligibility; ownership migration is automatic only when equivalence is cryptographically proven.

Validation

• labs/21-interlock/scripts/validate.sh
• go test ./...
• Windows CLI and E2E cross-compilation
• uv run --project labkit --extra dev pytest -q labkit/tests — 77 passed
• python -m labkit doctor --repo-root . — all four projections pass
• generated workflow YAML parse checks
• git diff --check

Rollout prerequisite

The downstream repositories currently have no active required-check protection on main. The generated sync workflow now fails closed until protections are enabled; after this PR lands, install the generated workflows and configure required checks before re-running fleet syncs.

[github-actions]

Pitot coding-agent E2E

Intelligence Flow is the verification source; Pitot's public README carries the latest main status.

Agent	Ubuntu	macOS	Windows	Result	Evidence
Claude	✅ Pass · real CLI 2.1.217 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.217 · native · binary-observed anthropic messages	✅ Pass · real CLI 2.1.217 · native · binary-observed anthropic messages	✅ Passing	All platforms are required
Cursor	✅ Pass · real CLI 2026.07.20-8cc9c0b · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.07.20-8cc9c0b · native · binary-observed cursor connect proto	✅ Pass · real CLI 2026.07.20-8cc9c0b · WSL · binary-observed cursor connect proto	✅ Passing	All platforms are required
Codex	✅ Pass · real CLI 0.145.0 · native · binary-observed openai responses	✅ Pass · real CLI 0.145.0 · native · binary-observed openai responses	✅ Pass · real CLI 0.145.0 · native · binary-observed openai responses	✅ Passing	All platforms are required
GitHub Copilot CLI	✅ Pass · real CLI 1.0.73 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.73 · native · binary-observed openai chat	✅ Pass · real CLI 1.0.73 · native · binary-observed openai chat	✅ Passing	All platforms are required
Gemini	✅ Pass · real CLI 0.51.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.51.0 · native · binary-observed gemini generate content	✅ Pass · real CLI 0.51.0 · native · binary-observed gemini generate content	✅ Passing	All platforms are required
Kimi Code	✅ Pass · real CLI 0.29.0 · native · binary-observed openai chat	✅ Pass · real CLI 0.29.0 · native · binary-observed openai chat	✅ Pass · real CLI 0.29.0 · native · binary-observed openai chat	✅ Passing	All platforms are required
OpenCode	✅ Pass · real CLI 1.18.4 · native · binary-observed openai responses	✅ Pass · real CLI 1.18.4 · native · binary-observed openai responses	✅ Pass · real CLI 1.18.4 · native · binary-observed openai responses	✅ Passing	All platforms are required
Pi	✅ Pass · real CLI 0.81.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.81.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.81.1 · native · binary-observed openai chat	✅ Passing	All platforms are required
Qwen Code	✅ Pass · real CLI 0.20.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.20.1 · native · binary-observed openai chat	✅ Pass · real CLI 0.20.1 · native · binary-observed openai chat	✅ Passing	All platforms are required

Runtime capabilities

Capability	Ubuntu	macOS	Windows	Result
pitot request	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Pass · real runtime allow/deny	✅ Passing

Source commit: 1a28a4f25961