feat(connector): split wire and adapter versions

[gnanirahulnutakki]

Summary

• separate structured framework wire compatibility from each connector opaque adapter contract version
• negotiate the highest exact version explicitly offered by both endpoints and fail closed on malformed, duplicate, major-incompatible, or minor-incompatible offers
• cap each offer at 32 versions, canonicalize descriptor inspection, and retain a defensive registry copy
• preserve existing fleet evidence protocol_version serialization and adapter provenance semantics
• document the accepted boundary in ADR 0014, the source-adapter spec, E12 mirrors, and the dated GSTACK session record

Closes #288.

Scope guard

This PR completes only the bounded F12.1a/F12.3a version seam. It does not complete #30 or E12. It adds no protobuf schema, generated code, gRPC dependency, subprocess, listener, discovery, credentials, network I/O, persistence migration, execution route, package, release, cluster mutation, or cloud resource.

Verification

• go mod verify
• pinned govulncheck v1.6.0: no vulnerabilities
• focused race-enabled connector, CLI, hydrator, and fleet tests
• negotiation fuzz target: 50,001 executions with four workers
• make ci: format, vet, lint, vulnerability, race, shell-policy, Prometheus rule, performance, binary end-to-end, and build gates
• make e2e-isolation: forced PostgreSQL RLS suites and two 50,000-execution fuzz targets
• make release-check: dual snapshot reproducibility, SBOMs, checksums, Homebrew formula, and multi-architecture OCI layout
• pinned kind suite: fleet fan-out, OCI image contract, and Argo Application projection under the race detector in 244.090 seconds; no clusters remained after teardown
• final whole-diff CodeRabbit review: zero findings across 18 files
• high-signal staged credential scan: clean
• signed commit verification: good SSH signature; DCO and GSTACK trailers present
• GitHub security queues before publication: Dependabot 0, code scanning 0, secret scanning 0

Security, reliability, and cost

Negotiation cannot silently interpret opaque evidence provenance as transport compatibility. Invalid or ambiguous offers fail before registration or use, and peer-controlled version lists are bounded. The change adds no authority, listener, process, credential, telemetry cardinality, cloud resource, or recurring cost.

Review focus

• explicit exact-set negotiation semantics and mismatch classification
• atomic descriptor validation and defensive-copy behavior
• unchanged fleet evidence serialization boundary
• nonclaims separating this compatibility seam from later transport and supervision work

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 81d81455-cd0e-470c-8b2b-febc550cf260

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/feat/e12-wire-version-split

---

_{Comment @coderabbitai help to get the list of available commands.}