Migrate EdgeProc CI/CD orchestration to Dagger

[hseshadr]

Outcome

EdgeProc repository-authored CI/CD is now orchestrated by Dagger. GitHub is limited to pinned event ingress and the approved artifact/OIDC bridges.

• canonical PR/main Dagger graph: quality, 90%+ branch coverage, real offline example, benchmark, locked dependency audit, snapshot + exact-commit history Gitleaks, and actionlint
• release candidate: exact green main is refetched by SHA, rebuilt without isolation from locked tools, metadata-validated, and exported with literal SHA-256 identity
• publication: requires a fresh manual main-branch Dagger candidate; a successful candidate triggers protected default-branch publish.yml, whose OIDC job has only pinned download-artifact + official PyPI publisher actions and no checkout, shell, install, build, or project execution
• no tag, workflow dispatch, package publication, or registry mutation performed

Evidence

• shadow before cutover: exact commit 9a807de hosted Dagger push + PR both green
• protection after shadow: strict required status is now Dagger
• local final: root gate green, 472 tests, 98.40% branch coverage
• local final Dagger: green in 1m40s; real example + benchmark + locked pip-audit + snapshot scan + 114-commit history scan + actionlint
• hosted cutover fdf89f7: Dagger green in 4m06s
• final trust-split a6e6118: hosted Dagger running

Deletion / LOC

• cutover commit: 186 lines added, 1,042 deleted
• GitHub ingress YAML: 458 → 124 handwritten lines (-334, -73%)
• full migration implementation (Dagger graph + release validator + ingress): 458 → 666 lines; the +208 is the newly executable exact-source/artifact/history contract
• implementation + focused contract tests: 1,413 → 1,501 lines (+88, 6.2%) while replacing 613 lines of hand-rolled workflow tests and removing duplicated inline release shell

Known fleet detector gap

The central consumer-drift classifier must recognize the approved bridge: a pinned upload-artifact may persist only the exact Directory returned by Dagger, and a source-free pinned download-artifact + official OIDC publisher may consume it. Treating every upload/download action as bespoke CI/CD would incorrectly reject the only privilege-separated operational bridge.