feat(stream): implement declared event ingress - #288

Summary

Implements the stream subsystem specified by #287 as the second PR in stack #294.

• admits typed nested stream declarations with command, argv, or external ingress
• lowers launched streams directly to lifecycle-coupled derived exec companions
• adds source-preserving st2 stream add/rm authoring
• adds bounded, idempotent st2 event emit ingress with keyed and keyless supersession
• publishes ordinary inbox records and reuses existing archive/DING safety
• resolves the st2 VRS implementation delta

Correctness properties

• predecessor archive happens before successor publication
• pending crash replay honors archive receipts and cannot restore an archived inbox copy
• concurrent replay publishes one canonical record; conflicting identity reuse fails closed
• strict discovery and retained no-follow capabilities guard recipient, state, inbox, and archive paths
• subjects reject control/newline frontmatter injection
• pending state stores a digest; the retained receipt ring is bounded at 128
• suspend/resume stops and relaunches stream companions with the owning agent
• list/read JSON exposes stable event identity and optional key

Verification

PASS:

• hosted nix flake check --print-build-logs on the reviewed head
• local nix flake check --print-build-logs (all 9 x86_64-linux checks)
• nix develop -c cargo fmt --all -- --check
• nix develop -c cargo check --workspace --all-targets
• event E2E: 13/13
• Agent Spec discovery: 55/55
• message CLI: 18/18
• authoring/direct-adapter, lifecycle, inventory, wire, and invariant proofs
• git diff --check

Additional diagnostic sweeps:

• the broad non-hermetic Cargo sweep retains the same inherited failure set as docs(vrs): add the 04-stream subsystem intent layer #287
• strict VRS checking retains pre-existing stale anchors and draft-decision findings

Canonical evals

Canonical conformance and failure-capable E2E proof are shipped in compoundingtech/evals#79, exact-pinned to this PR head. Merge evals #79 after this stack; immutable release provenance follows publication.

Stack

• docs(vrs): add the 04-stream subsystem intent layer #287 - VRS/design
• feat(stream): implement declared event ingress #288 - implementation and executable proofs

_{Stack created with GitHub Stacks CLI}