feat: derive flagship maturity from signed admissions

[abrichr]

Outcome

• Derive the flagship public lifecycle from the exact, hash-pinned OpenAdapt Ops projection and its canonical signed-admission validator chain.
• Render target-state qualification requirements when no current admission is active. Render only an immutable historical admission record when a matching admission exists. Do not make a present-tense Production claim from a static README snapshot.
• Require both active product admissions for the exact component and deployment releases and an active signed, expiring, revocable admission for the exact compiled workflow version.
• Require at least three trials per task and condition. Require the closed result schema to report silent incorrect success and over-halt.
• Reject static package lifecycle classifiers. Remove hard-coded Beta, Experimental, reference-path, and browser-only maturity assertions from public flagship copy.
• Publish all eight governed terminal transaction outcomes. Only VERIFIED is Production success.

The lifecycle source is OpenAdaptAI/openadapt-ops commit ef29c08ad27b05637abc75fc3ceb3e026821fdda. The projection digest is sha256:6c3819c7c68acb1bea8045fa1f059721e535c960707998b8705438f8541fb3d7. The schema digest is sha256:f681a9bb47ff727b409df994e69e62e7c45b38e912911af4c99eca7dd3be40eb.

Validation

• Production lifecycle validator chain and current-source check: passed
• Test suite: 188 passed, 1 skipped
• Focused lifecycle, release-artifact, and CLI tests: 75 passed
• Ruff check and changed-file format check: passed
• Platform manifest offline validation: passed with 0 warnings
• Source-availability boundary: passed
• actionlint: passed
• Built wheel and sdist artifact verification: passed
• Authenticated online platform-manifest validation: passed with 0 warnings