feat(python): durable transaction subsystem and Kiro IDE 1.0 adapter

Land the crash-recoverable managed-file transaction engine (journal,
staging, commit, restart recovery, opaque snapshots, private artifacts,
Windows DACL hardening) and the Kiro IDE 1.0 workspace hook plugin with
legacy migration.

Repair five defects that kept the suite red (426 failures to zero):

- Anchor the transaction state directory at ~/.elydora/transactions
  instead of the shared system temp directory. The recovery journal now
  shares fate with the runtimes it repairs, survives temp cleaners, and
  isolates naturally under per-test fake homes.
- Skip pending-transaction recovery when no state directory exists so
  rejected installs never create runtime directories.
- Create the runtime root's parent before hardening it, matching the Go
  SDK's expand behavior for fresh homes.
- Stop using file timestamps as identity evidence: Windows exposes
  mtime/ctime with delayed cross-handle visibility. Reads now prove
  stability through a verification re-read; snapshots compare device,
  inode, size, and SHA-256.
- Stop comparing synthetic Windows permission bits across stat
  boundaries: path stats derive execute bits from file extensions while
  handle stats do not, which falsely flagged every managed .cmd wrapper.
  Snapshots store raw modes for restoration and compare portable bits.

Reservation cleanup now verifies content before discarding so a
concurrent writer's file at a rollback path is preserved, and the
install-failure tests assert the precise contract: no agent runtime
residue, with the durable state directory allowed to remain.

Gates: pytest 807 passed, mypy clean, pip check clean, wheel builds.

elydora/cli.py

@@ -9,7 +9,6 @@ from __future__ import annotations
 import argparse
 import json
 import os
-import shutil
 import sys
 from typing import Dict, NamedTuple, NoReturn, Optional, Type
 
@@ -42,6 +41,11 @@ from .plugins.letta import LettaPlugin
 from .plugins.opencode import OpenCodePlugin
 from .plugins.qwen import QwenPlugin
 from .plugins._file_io import write_text_atomic
+from .plugins._runtime_removal import (
+    commit_runtime_removal,
+    prepare_runtime_removal,
+)
+from .plugins._transaction import recover_pending_transactions
 
 
 PLUGIN_MAP: Dict[str, Type[AgentPlugin]] = {
@@ -180,6 +184,7 @@ def _get_plugin(agent_name: str) -> AgentPlugin:
 
 def cmd_install(args: argparse.Namespace) -> None:
     """Handle the 'install' subcommand."""
+    recover_pending_transactions()
     agent_name: str = args.agent
     agent_dir = _resolve_agent_directory_or_exit(args.agent_id)
     plugin = _get_plugin(agent_name)
@@ -215,9 +220,10 @@ def cmd_install(args: argparse.Namespace) -> None:
         config["token"] = secrets.token
     plugin.preflight_install(config)
 
-    # Create per-agent directory under ~/.elydora/{agent_id}/
-    ensure_private_directory(runtime_root())
-    ensure_private_directory(agent_dir)
+    # Transactional adapters create and recover their own runtime directories.
+    if not getattr(plugin, "manages_runtime_directories", False):
+        ensure_private_directory(runtime_root())
+        ensure_private_directory(agent_dir)
 
     # Generate and write the guard script for adapters that use the shared runtime.
     if not plugin.manages_guard_runtime:
@@ -235,6 +241,7 @@ def cmd_install(args: argparse.Namespace) -> None:
 
 def cmd_uninstall(args: argparse.Namespace) -> None:
     """Handle the 'uninstall' subcommand."""
+    recover_pending_transactions()
     explicit_agent_id = getattr(args, "agent_id", None)
     elydora_dir = runtime_root()
     agent_id = explicit_agent_id
@@ -273,15 +280,24 @@ def cmd_uninstall(args: argparse.Namespace) -> None:
         agent_directory_exists = True
 
     plugin = _get_plugin(args.agent)
+    manages_runtime_removal = getattr(
+        plugin, "manages_runtime_removal", False
+    )
+    runtime_removal = (
+        None
+        if not agent_directory_exists or manages_runtime_removal
+        else prepare_runtime_removal(agent_id, args.agent)
+    )
     plugin.uninstall(agent_id=agent_id)
 
-    if agent_directory_exists:
-        shutil.rmtree(agent_dir)
+    if runtime_removal is not None:
+        commit_runtime_removal(runtime_removal)
         print(f"  Removed agent directory: {agent_dir}")
 
 
 def cmd_status(args: argparse.Namespace) -> None:
     """Handle the 'status' subcommand."""
+    recover_pending_transactions()
     print("Elydora Agent Hook Status")
     print("=" * 40)
     for name in get_agent_names():