feat(python): durable transaction subsystem and Kiro IDE 1.0 adapter

Land the crash-recoverable managed-file transaction engine (journal,
staging, commit, restart recovery, opaque snapshots, private artifacts,
Windows DACL hardening) and the Kiro IDE 1.0 workspace hook plugin with
legacy migration.

Repair five defects that kept the suite red (426 failures to zero):

- Anchor the transaction state directory at ~/.elydora/transactions
  instead of the shared system temp directory. The recovery journal now
  shares fate with the runtimes it repairs, survives temp cleaners, and
  isolates naturally under per-test fake homes.
- Skip pending-transaction recovery when no state directory exists so
  rejected installs never create runtime directories.
- Create the runtime root's parent before hardening it, matching the Go
  SDK's expand behavior for fresh homes.
- Stop using file timestamps as identity evidence: Windows exposes
  mtime/ctime with delayed cross-handle visibility. Reads now prove
  stability through a verification re-read; snapshots compare device,
  inode, size, and SHA-256.
- Stop comparing synthetic Windows permission bits across stat
  boundaries: path stats derive execute bits from file extensions while
  handle stats do not, which falsely flagged every managed .cmd wrapper.
  Snapshots store raw modes for restoration and compare portable bits.

Reservation cleanup now verifies content before discarding so a
concurrent writer's file at a rollback path is preserved, and the
install-failure tests assert the precise contract: no agent runtime
residue, with the durable state directory allowed to remain.

Gates: pytest 807 passed, mypy clean, pip check clean, wheel builds.

elydora/plugins/_opaque_snapshot.py

@@ -0,0 +1,119 @@
+"""Bounded-memory snapshots for identity-sensitive opaque files."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import os
+import stat
+from typing import Optional
+
+from ._managed_files import portable_file_mode
+from ._pinned_directory import PinnedDirectory
+
+
+_HASH_CHUNK_BYTES = 1024 * 1024
+
+
+@dataclass(frozen=True)
+class OpaqueFileSnapshot:
+    """Content and physical identity without retaining file bytes in memory.
+
+    Identity is content-based (device, inode, mode, size, SHA-256). File
+    timestamps are excluded because Windows exposes them with delayed
+    visibility across handles, which makes them unsound identity evidence.
+    """
+
+    device: int
+    inode: int
+    mode: int
+    size: int
+    sha256: str
+
+
+def _metadata(metadata: os.stat_result) -> tuple[int, int, int, int]:
+    return (
+        metadata.st_dev,
+        metadata.st_ino,
+        portable_file_mode(metadata),
+        metadata.st_size,
+    )
+
+
+def _same_metadata(first: os.stat_result, second: os.stat_result) -> bool:
+    return _metadata(first) == _metadata(second)
+
+
+def _require_regular(
+    metadata: os.stat_result,
+    file_path: str,
+    label: str,
+    require_owner_only: bool,
+) -> None:
+    if not stat.S_ISREG(metadata.st_mode) or stat.S_ISLNK(metadata.st_mode):
+        raise OSError(f"{label} path is not a physical file: {file_path}")
+    if os.name != "nt" and require_owner_only and metadata.st_mode & 0o077:
+        raise PermissionError(
+            f"{label} must be accessible only by its owner: {file_path}"
+        )
+
+
+def stream_opaque_snapshot(
+    directory: PinnedDirectory,
+    file_path: str,
+    label: str,
+    *,
+    require_owner_only: bool = True,
+) -> Optional[OpaqueFileSnapshot]:
+    """Hash one no-follow regular file in bounded chunks through a pinned parent."""
+    name = directory.name_for(file_path)
+    try:
+        before = directory.stat_file(name)
+    except FileNotFoundError:
+        return None
+    except OSError as error:
+        raise OSError(f"Inspect {label} at {file_path}: {error}") from error
+    _require_regular(before, file_path, label, require_owner_only)
+
+    flags = os.O_RDONLY | getattr(os, "O_BINARY", 0)
+    flags |= getattr(os, "O_CLOEXEC", 0) | getattr(os, "O_NOFOLLOW", 0)
+    descriptor = -1
+    try:
+        descriptor = directory.open_file(name, flags)
+        opened = os.fstat(descriptor)
+        _require_regular(opened, file_path, label, require_owner_only)
+        if not _same_metadata(opened, before):
+            raise OSError(f"{label} changed while opening: {file_path}")
+        digest = hashlib.sha256()
+        while True:
+            chunk = os.read(descriptor, _HASH_CHUNK_BYTES)
+            if not chunk:
+                break
+            digest.update(chunk)
+        finished = os.fstat(descriptor)
+        _require_regular(finished, file_path, label, require_owner_only)
+        if not _same_metadata(finished, opened):
+            raise OSError(f"{label} changed while hashing: {file_path}")
+    except OSError as error:
+        raise OSError(f"Read {label} at {file_path}: {error}") from error
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+
+    try:
+        visible = directory.stat_file(name)
+    except FileNotFoundError as error:
+        raise OSError(f"{label} changed while hashing: {file_path}") from error
+    _require_regular(visible, file_path, label, require_owner_only)
+    if not _same_metadata(visible, finished):
+        raise OSError(f"{label} changed while hashing: {file_path}")
+    return OpaqueFileSnapshot(
+        finished.st_dev,
+        finished.st_ino,
+        stat.S_IMODE(finished.st_mode),
+        finished.st_size,
+        digest.hexdigest(),
+    )
+
+
+__all__ = ["OpaqueFileSnapshot", "stream_opaque_snapshot"]