Support digest-pinned source-only Tenant bootstrap #5259

🤖 Generated by the Agentic Engineer

Problem and audience

The operator needs to inspect the exact business-site release before allowing its workloads to start. The current Tenant graph always selects a floating release and creates an application Kustomization. It cannot represent a digest-pinned, source-only bootstrap without bypassing the typed Tenant contract.

Evidence and proposed change

Platform main 840972ba426ed11e6ad5bf328335995464667af1 has fourteen Tenant graph nodes but compiler/API coverage only for WebApp. Closed #5163 and #5195 supply WebApp process/private-input capabilities and WebApp compilation, not this Tenant source/lifecycle mechanism. The business-site v1.0.3 publication exists; #5247 still owns actual consumer approval, source registration, private inputs and live staging acceptance.

Add an optional typed digest/publisher-revision pair and an application-reconciliation selector. Keep omitted inputs identical to the current graph. The source-only state omits both application Kustomizations rather than suspending one. Activation is explicit and cannot be reversed into child pruning through the selector. Use the existing KRO compiler fixture and real generated API admission, not a second rendering approximation.

Acceptance

• Omitted new inputs preserve the existing release selector, signer predicate, namespace/identity/isolation resources and SOPS/non-SOPS child outputs.
• The optional source pair resolves exactly one digest selector and one anchored maintained-publisher identity, retaining the fixed repository URL and issuer. Reject partial, malformed and unknown inputs; syntax validity is not consumer approval.
• Initial source-only mode creates no application Kustomization. Explicit activation creates the correct one; enabled-to-source-only changes are rejected, including originally omitted defaults.
• Compile the committed Tenant with actual pinned KRO 0.9.4, actual dependency schemas, API discovery and strict generated admission. Assert all fourteen node identities, included/ignored sets, default and SOPS branches, activation, and invalid configurations. Preserve the existing WebApp tests.
• Extend the source/signing guards narrowly for the exact reviewed constructor; preserve existing legacy matcher floors, standalone-source refusals, graph-mutation checks and production-instance conservation. Regenerate generated evidence normally.
• Update the Tenant operating documentation, pass affected validation and normal current-head review/CI/protected merge, then verify the merged graph/compiler result.

Boundaries and success signal

Success is a compiler/API-proven source-only Tenant capability with no output change for existing declarations. No business-site production Tenant, publisher approval, route, private value, portal, database or payment activation is included. Those remain #5247's adoption work. The public site and production hostname remain unchanged. No new paid services.

Priority High: this removes the next code prerequisite for the maintainer-requested portal deployment. Effort Medium including compiler, guard, review and deployment verification; Standard service class. This is an independently testable delivery child of #5247, not its completed staging acceptance. WIP limits are waived by the maintainer for this session; all other gates remain.

Part of #5247.