[Dav-14]

Summary

Stacked on #174. Aligns fctl with the Connectivity tenant API at 4084c5667ca17ce1ff3e0a5d6364ce5f3072e77f; tracked in EN-2885.

- fctl connectivity connectorinstances
+ fctl connectivity connections  # singular alias: connection
- spec.connector, spec.config, spec.startSequence
+ spec.connectorRef: {name}, spec.env, spec.files, spec.initialCursor (base64)

Installs explicitly default to channel: stable, reject conflicting/empty selectors, and clear the other selector when switching. Configure rejects Ledger rebinding. Channel resolution skips opaque tags and does not use an opaque applied version as a SemVer floor. Branding, version metadata, confirmation and redaction remain covered.

Compatibility paths are removed: configuration files/schemas must use env/files; configure requires a stored or explicit selector; reads reject unbound instances and resolved versions without a connector identity. Pending instances remain readable. HTTP routes and JSON output envelope keys remain unchanged.

Updates the command guide and documents the existing client facade's requirements and official SDK adoption gap. No server visibility workaround is included.

Structured YAML/JSON decode failures report the input file, available line numbers and expected structure without echoing scalar values, keys, tags or aliases from decoder messages. SDK generation now refreshes both nested modules before tidying the root dependency graph, so the Dirty validation gate can complete without module drift.

The Dirty pre-commit step uses GODEBUG=http2client=0 to avoid repeated HTTP/2 stream resets from Go proxy downloads. TLS and checksum verification remain enabled, and the test and generation gates are unchanged.

Evidence

• Before: feat(connectivity): add connector and connector-instance commands #174 sends the retired connector/config representation, offers Ledger rebinding and assumes an applied version is SemVer.
  After: command regression tests and local HTTP integration tests assert the current tenant POST/PATCH shapes, selectors, opaque cursors and immutable Ledger behavior.
• Passed under Nix: full just tests, just pre-commit (0 lint issues), go build, both nested SDK test suites and go mod verify. Repeated SDK generation/pre-commit produced an identical diff.
• Connection command coverage is 87.2%. Redaction regressions cover malformed YAML/JSON in install and configure: environment values, reference fields, files, modes, duplicate keys, aliases and tags; errors retain available line numbers without exposing the secret sentinel.
• Local cold-cache downloads passed for the three modules affected by CI transport failures; the HTTP/1.1 pre-commit run passed with 0 lint issues.
• Current-head CI passed Tests, Dirty and PR-title checks on 9251ff7d5068c3dbfae215bd8f41e6efffe9a339. GoReleaser is outside this feature-branch validation path and was skipped.
• Independent review passed the Principal Engineer, Product Engineer and SRE lenses for the redaction and transport changes, with no unresolved local findings.
• Tests use local fake transports/HTTP servers; no deployed stack is qualified.

Merge Danger

Door: two-way

The code can be reverted. Users must update scripts to connections; this CLI requires the new Connectivity tenant wire contract. The old command group and --start-sequence are removed; --initial-cursor uses base64 and does not reset an active ingestion cursor.

Blast Radius: Connectivity

CLI/API compatibility and schema selection for Connectivity connections. This change performs no data migration, release or deployment.