Adopt core 0.5.0: declared verb scope; scoped deferred captures close D-CAM-29

[mbreissi]

Adopts the core 0.5.0 breaking command surface (rust-lib/v0.5.0, a14a3285) and closes the D-CAM-29 recorded gap.

What changed

• Pin + lock. edgecommons pinned at rust-lib/v0.5.0; Cargo.lock regenerated with the local [patch] inactive, so it stays git-sourced and reproducible for CI (D-CAM-27 convention).
• Declared verb scope (D-SC-2). Every verb registers through the two-form surface register(verb, scope, handler) / register_outcome(verb, scope, handler) with a CommandScope derived from its closed request schema:
  • Component: sb/list, sb/discover, sb/capture-group, sb/capture-group-submit, sb/capture-cancel — the library now refuses any instance addressing; the hand-rolled refusal is deleted.
  • Instance: sb/capture, sb/capture-submit, sb/reconnect, sb/ptz, sb/ptz-presets, sb/pause, sb/resume.
  • Both: sb/status, sb/capture-status, sb/queue-status, sb/queue-clear — no addressing means the whole component.
• D-CAM-29 closed. sb/capture (Instance) and sb/capture-group (Component) move onto the scoped outcome registration: the topic token now routes a deferred capture, with deferred settlement, permit release, and sb/capture-cancel settling the held reply unchanged.
• §2.2 helper layer deleted. scoped_request (adapter-side conflict/scope enforcement) is gone — the library owns addressing pre-dispatch (conflict-first BAD_ARGS, Component rejection). The remaining addressed_request only seeds the library-resolved token into the body selector; the optional-iff-one default and NO_SUCH_INSTANCE existence check stay adapter-side per D-SC-4.
• Keepalive instance state (D-SC-7). The state keepalive's instances[] state comes from the single state model that answers sb/status: a camera paused with sb/pause reports PAUSED while connected keeps reporting reachability; the exact wire element is pinned via the now-public InstanceConnectivity::to_json.
• Docs/registers. messaging-interface.md scope table + addressing rules; metrics.md keepalive vocabulary incl. PAUSED; DESIGN.md D-CAM-29 marked closed with new decision D-CAM-30 (and §12.1/§27 narrative); AGENTS.md invariants.

Tests

New coverage: scope-declaration and body-seeding units; an addressed deferred sb/capture routing test (topic token selects the camera with two configured); a PAUSED keepalive wire pin via to_json; named dispatch-pipeline tests; and a live-inbox integration over an in-process MessagingService loopback that drives the REAL CommandInbox (now-public CommandInbox::new) across the adapter's actual registrations, asserting the byte-pinned library refusals ("instance in body conflicts with the addressed instance", "verb 'sb/list' is component-scoped"[ + " - the body must not name an instance"]).

Also: the k8s deployment-config contract test normalizes CRLF so it runs on Windows autocrlf checkouts (it failed at baseline on such checkouts, before this change).

Validation

• Baseline (0.4.0 pin): 636 lib tests green (the k8s configmap test failed on the Windows CRLF checkout only — pre-existing, fixed here).
• After: cargo test — 643 passed, 0 failed, 1 ignored (lib 639 + integration suites).
• cargo clippy --all-targets -- -D warnings clean.
• Coverage gates (local, mirroring the CI job): bundle line coverage 92.61% (gate 90); diff coverage 100% of changed lines (gate 95).

Behavior changes on the wire

• An instance-addressed sb/capture now routes by the topic token (previously the token was ignored); a conflicting body instance is refused.
• An instance-addressed sb/capture-group is now refused BAD_ARGS (previously silently accepted with the token ignored).
• Component-scope refusal messages are now the library's byte-pinned texts (codes unchanged: BAD_ARGS).
• The keepalive may now report state: "PAUSED".