feat(control-plane): provisionTenant()/deprovisionTenant() orchestration behind an injectable driver interface (fake driver only)

[JSONbored]

Context

#7180 needs a real provisioning core, but the maintainer's own 2026-07-18 research comment on that
issue found a genuine open business/architecture question blocking the real implementation: how a
per-tenant Postgres actually gets provisioned (Cloudflare Hyperdrive fronting a managed Postgres vs.
a self-run pool vs. something else) — that decision is explicitly not made yet and is out of
scope here.

The same comment, however, recommended a concrete, immediately-buildable piece that doesn't wait on
that decision: write provisionTenant()/deprovisionTenant() as real orchestration logic — create-
container, provision-DB, inject-secrets-via-#7174's-broker as explicit steps — behind an
injectable driver interface, fully tested against a fake/in-memory driver. This mirrors an
existing, proven pattern in this monorepo: packages/loopover-engine/src/miner/driver-factory.ts's
CodingAgentDriver interface, which ships a createFakeCodingAgentDriver/createNoopCodingAgentDriver
alongside its real CLI-subprocess/Agent-SDK drivers specifically so orchestration logic can be fully
tested without any real external dependency. This issue applies the identical shape to tenant
provisioning.

Note: this is genuinely greenfield. The control-plane/ package referenced in #7173's ratified
location decision (a new standalone package, repo-root, alongside review-enrichment/) does not
exist in the repository yet. This issue's own deliverables include bootstrapping that package's
skeleton to the minimum needed to host this code — mirror review-enrichment/'s existing structure
(package.json, tsconfig.json, src/, test/) as the precedent for a new repo-root TypeScript
package, rather than inventing a different layout.

⚠️ Hard constraint, read before starting. This issue's deliverable is the orchestration logic
and its driver interface, tested only against a fake/in-memory driver. It explicitly does not
include: a real Cloudflare Containers API call, a real Postgres provisioning call, or any live
infrastructure credential. A PR that wires a real Cloudflare Containers or Postgres SDK call does
NOT resolve this issue — that work is separate, blocked-on-the-still-open-Postgres-provider-decision
follow-up work, not this issue's scope.

Requirements

1. Define a TenantProvisioningDriver interface covering the three steps Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's own comment names
   explicitly: create-container, provision-DB, inject-secrets (the last one calling into Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174's
   already-merged broker-generalization work for credential injection — do not hand-roll a separate
   secrets path).
2. Implement provisionTenant(tenant, product, driver) / deprovisionTenant(tenant, product, driver)
   as real orchestration logic against that interface only — product-agnostic (same call shape for
   an ORB tenant and an AMS tenant, per Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's own "product-agnostic" deliverable).
3. Provide a fake/in-memory driver implementation (mirroring createFakeCodingAgentDriver's shape —
   an in-memory map standing in for "a container exists"/"a DB exists," toggled by the same
   create/destroy calls) sufficient to exercise the full lifecycle in tests.
4. Bootstrap the control-plane/ package skeleton (package.json, tsconfig, test runner) only to the
   extent needed to host this module — no unrelated scaffolding.

Deliverables

• control-plane/ package skeleton (mirroring review-enrichment/'s structure)
• TenantProvisioningDriver interface (create-container / provision-DB / inject-secrets shape)
• provisionTenant() / deprovisionTenant() orchestration logic implemented against the
  interface, product-agnostic
• A fake/in-memory driver implementing the interface, used only in tests (no real Cloudflare or
  Postgres dependency anywhere in this issue's test suite)
• Tests matching Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's own stated acceptance shape: create → container "exists"/reachable (via
  the fake) → destroy → container "gone" (via the fake)

Test Coverage Requirements

New code under a new control-plane/ package — if this package is not added to the root Codecov
coverage.include alongside src/**/workers/**, note that explicitly in the PR so a future
reader isn't confused about why Codecov doesn't gate it (matching this repo's own documented
convention for apps/**-style exclusions). If it can be included, target the same 99%+ patch bar as
src/**. Either way, the orchestration logic and both driver-lifecycle branches (success and
destroy-of-nonexistent-tenant) need explicit test coverage.

Expected Outcome

provisionTenant()/deprovisionTenant() exist as real, fully-tested orchestration logic with a
clean driver seam. Once the Postgres-provider decision is eventually made, a real driver can be
written and swapped in without touching this orchestration code at all — the same way
driver-factory.ts's real CLI drivers slot in next to its fake one today.

Links & Resources

• Parent: Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (design/research comment, 2026-07-18)
• packages/loopover-engine/src/miner/driver-factory.ts — the injectable-driver precedent this
  mirrors (CodingAgentDriver, createFakeCodingAgentDriver)
• src/selfhost/pg-adapter.ts — existing driver-shape precedent the eventual real Postgres driver
  should conform to (not needed for this issue, cited for whoever picks up the real-driver follow-up)
• review-enrichment/package.json — structure precedent for bootstrapping the new control-plane/
  package
• Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174 (broker generalization, merged via feat(orb): add a secret_type discriminator to the enrollment broker #7187) — the secrets-injection path to call into, not
  reimplement

[linear-code]

JSO-5349