feat: bind governed Developer OS plans to HPL/OpenHands payloads v2

[Mopati123]

Purpose

Extend certified Developer OS v1 into v2 by translating deterministic developer-plan scopes into HPL-compatible OpenHands admission payloads.

v2 bindings

• repo.read → OPENHANDS_REPO_READ
• test.execute → OPENHANDS_TEST_EXECUTE
• repo.patch → OPENHANDS_REPO_PATCH

Each generated binding includes:

• ProposalEnvelope-compatible proposal
• CapabilityRequest-compatible request
• AgenticAdmissionPolicy-compatible policy
• deterministic binding SHA-256

Authority boundary

The bridge does not import or execute the HPL kernel and does not call OpenHands.

Every binding records:

• authority_semantics=hpl_admission_required
• execution_authorized=false

For repo.patch, the payload sets allow_consequential=true, but mutation remains impossible until HPL admits the request and mints an ExecutionToken.

Scope discipline

• reads must remain inside the Developer OS readable path set;
• tests must remain inside the impacted test set and use the fixed python_unittest runner;
• patches may target only the Developer OS writable path set;
• protected branches are refused;
• preimage and replacement SHA-256 values are bound into patch scope.

Truth boundary

This tranche proves deterministic cross-repo contract compatibility at the payload level. It does not yet perform live HPL/OpenHands execution.

Review order

This PR is stacked on certified Developer OS v1 and remains draft until CI passes.

Certified Phase N v2 baseline

At head debf6dd872dca2fa8bbfb6707c7518918894c0c9, the dedicated Repository Intelligence CI completed successfully.

Certified v2 additions:

• deterministic HPL-compatible bindings for repo.read, test.execute, and repo.patch;
• exact ProposalEnvelope / CapabilityRequest / AgenticAdmissionPolicy payload shapes;
• explicit hpl_admission_required authority semantics;
• execution_authorized=false on all emitted bindings;
• consequential patch payloads bound to branch, path, preimage SHA-256, replacement SHA-256, timeout, and size bounds.

Truth boundary: v2 proves payload-level contract compatibility only. It does not itself execute HPL or OpenHands.

This commit is the certified Phase N v2 baseline. PR remains draft and unmerged.