feat(wrapper): unify orro-product-wrapper into the publishable orro package (in-process witnessd delegation)

[moonweave]

Reconciliation

This makes the ORRO repo the single canonical, version-controlled source of the published-name orro package. It reconciles the repo's former orro-product-wrapper skeleton with the working standalone orro 0.0.3 design:

• distribution renamed from orro-product-wrapper to orro;
• version set to 0.1.0, superseding published 0.0.3;
• runtime dependency declared as witnessd>=2.3.2;
• subprocess python -m orro delegation replaced with in-process witnessd.__main__ delegation;
• orro_wrapper remains the import package and owns both orro and the orro-wrapper compatibility entry point;
• PyPI publication is deliberately excluded and remains a separately approved step.

No witnessd or Depone source was changed. The wrapper still contains no engine logic and retains the existing proof/verifier/approval/assurance boundary fields.

Dispatch order

1. boundary, self-test, and delegate stay wrapper-local.
2. A command in witnessd.__main__.ORRO_COMMANDS routes to witnessd_main(["orro", *args]).
3. Any other positional command gets an ORRO-owned unknown command diagnostic, closest-match suggestion when available, the union of witnessd and local commands, and exit 2.
4. Existing flag handling remains local. Missing witnessd produces an install pointer and nonzero exit.

RED and verification

RED was observed before implementation: flowplan --help reached the deprecated subprocess shim and the patched in-process witnessd_main mock was called zero times.

Fresh verification on /usr/bin/python3:

• python3 scripts/check_orro_wrapper.py — pass
• python3 scripts/check_orro_repo_contract.py — pass
• configured ORRO CI contract/self-test suite — pass
• python3 scripts/check_orro_command_migration_dry_run.py --json — pass
• python3 scripts/check_orro_wrapper_install.py --json — pass
• python3 scripts/check_orro_wrapper_distribution.py --json --allow-network — pass
• python3 -m build — built orro-0.1.0.tar.gz and orro-0.1.0-py3-none-any.whl
• python3 -m pytest -q — no tests collected, exit 0; repository tests are the configured checker suite above
• git diff --check — pass

The full pinned-engine E2E could not run in this fresh local clone because sibling ../witnessd and ../Depone checkouts are absent. Its wrapper regression was updated to install the declared dependency; GitHub's E2E workflow supplies those pinned checkouts and is the authoritative rerun.

Live smoke

Processing ./dist/orro-0.1.0-py3-none-any.whl
Collecting witnessd>=2.3.2
Using cached witnessd-2.3.3-py3-none-any.whl
Successfully installed orro-0.1.0 witnessd-2.3.3

$ orro flowplan --help
usage: witnessd flowplan [-h] ... goal

$ orro bogus
orro: unknown command 'bogus'
Valid commands: advise, advisory-provenance-check, auto, boundary, delegate, doctor, engine-lock, flowplan, handoff, init, lock, next, proofcheck, proofrun, report, review, scout, self-test, setup, sketch, team, trace
exit 2

$ orro boundary
{"kind": "orro-wrapper-info", "version": "0.1.0", "published_package": false, "boundary": {"contains_engine_logic": false, "implements_proofrun": false, "implements_proofcheck": false}}

$ python3 scripts/check_orro_repo_contract.py
ORRO repo contract: pass

[moonweave]

Closing — scope discovery. Making the ORRO repo the source of the published orro package is larger than a mechanical rename: the repo's contract deliberately enforces two invariants that publishing would flip —

1. scripts/check_orro_repo_contract.py requires the packaging/release docs to state the "published ORRO package remains future work"; publishing contradicts that.
2. check_orro_wrapper.py requires dependencies = [] (thin, no-dep wrapper); the standalone package needs witnessd>=2.3.2.
3. The pinned-engine-smoke intentionally validates subprocess delegation to a pinned ../witnessd sidecar, so the in-process delegation switch (from the first attempt) breaks it.

So the reconciliation is a deliberate strategy change (ORRO flips from 'unpublished thin skeleton' to 'published product package'), touching docs + contract, not just packaging. Re-doing cleanly with subprocess delegation kept and the invariant docs/contract updated, pending a go/no-go on that direction.

[moonweave]

Superseded by #53 (merged), which unified the wrapper with subprocess delegation kept and all CI checks + pinned-engine-smoke passing.