feat(bridge): import the complete optional Kars Bridge application

[Pal Lakatos-Toth (pallakatos)]

Complete application, optional add-on

Imports the complete existing Kars Bridge application under bridge/: Rust BFF,
Next.js Workspace/Console/Audit, optional Microsoft Teams gateway, separate Helm
chart, development entrypoints, product documentation and acceptance fixtures.
All 398 original product paths remain present; bounded module extraction adds
files without dropping application surfaces.

Target: Azure/kars:kars-bridge. Draft integration candidate, not release-ready.

Current head: c3e8e911f0cf25a188e2469ac03093596980635a.
It includes the actual integration merge b5ad6791, the merged evaluator
corrections from #562, and prerequisite #554 through
7dad5417a5177b29823381323a3144af86b008df.
This adds the four installer corrections, CREATE-held bare-Sandbox and verified
Task-caller bundle recovery, late observer retirement/requalification, and
secret-safe gate diagnostics. The source-reviewed historical SRE canonical-schema
migration is now composed, alongside the corrected dual-profile fixtures.
Its corresponding standalone candidate is #554 at 0fce464c.
Actual migration/runtime qualification remains pending; source review is not a
native success claim.

Core remains independently usable. Bridge has a separate Rust workspace/lock,
independent npm packages, opt-in build targets and a separate Helm release.
Installation/removal must preserve core resource identities and customer data.
The existing /sandbox filesystem remains ephemeral; no PVC feature is added.

The import preserves original author notices and excludes private Git ancestry,
credentials, operator state, cluster overlays, dependency caches and frozen
SDK/probe changes. Existing registry defaults are configuration compatibility,
not evidence that public images have been published.

Current qualification

All CI executes in Azure/kars, without publishing images or deploying to
existing clusters. Current-head workflows:

Qualification	Run	Status at this update
Bridge components, actual BFF/web builds, audits and add-on removal	34670993719	Passed
Same-head native core/Bridge API and runtime contracts	34670993704	All three cold API installs passed; runtime 14 passed, 1 failed, 3 blocked
Core independently, with Bridge physically absent	34670993721	Running
Source gates	34670993746	Current run; attribution and scope-audit requirements remain unresolved

The preceding 3c5a0b8c native run
again passed 14 runtime cases and all three API installs. The fixture correction
worked: the observer now reached genuine CLI preview, which failed inside
reviewLateScope. Its exact leaf module was missing from the redactor's
allowlist. This head retains only that module's source location and fixed error
categories; no validation or authority check was relaxed.

The current run now identifies the actual leaf at
private-activation-late-scope.js:348: the fresh Sandbox readiness/snapshot
comparison. It occurs before private-material inventory. The same-window
snapshot is Running with current generation, but does not distinguish all four
comparisons at the failing instant. That consistency check is being investigated;
no resourceVersion, readiness or authority fence is being waived.

A separate follow-up is prepared but not included here: real offline kubectl
execution proved that go-template={{json .metadata}} is unsupported. The
replacement uses the supported metadata-only JSON printer, with strict shape
and error handling, for late enrollment and both budget-TLS metadata reads.
That is a real later-path defect, not the first native failure identified above,
and is not relabeled as completed live enrollment.

The preceding 87813d51 native run
passed all three cold API installs and 14 runtime cases: real source delivery,
source-UID revocation, Team rebind, writer uninstall and grant-revocation shutdown
now pass alongside the earlier enrollment/negative cases. Only observer setup
failed; its three downstream TLS/CNI/rotation cases remained blocked.

The observer Task was genuinely Running. The failure was reproduced in the
native fixture: it read absent legacy spec.credentialsRef instead of the
governed v2 Task bundle. This head corrects only that fixture and its tests,
following the actual Task UID anchor, bundle ownership and projection source
UID. All source/bundle/projection preservation checks remain; 118 fixture unit
cases pass. This is not yet proof that late enrollment/TLS/CNI succeeds.

Core 7dad5417 Rust job
passed 3,025 tests, including all 27 bundle cases and six actual controlled-API
observer-fence tests. Kind still failed at the separate SRE apply preparation
boundary. Controlled API tests are not live observer qualification.

This head completes the remaining UI source-size splits without moving state,
hooks, server actions, data fetching or approval gates. The unchanged public LOC
gate passed publicly at 3f7a014c, alongside all eleven
Bridge component jobs.
It also passes locally after this composition. A mismatched local Next cache was
not accepted as framework proof; the new head requires its own hosted results.

Preceding 3f7a014c runtime evidence:
all three cold API installs passed; runtime finished with 10 passed, 2 failed and
6 blocked. Actual writer enrollment, active-grant updates,
negative authority cases and Team rebind passed. Both native-delivery-a and the
Task-owned native-observation-task Sandbox stopped before Pods with
source_or_grant:bundle_owner. Neither the bare Sandbox nor the actual owning
Task had a recorded bundle UID; a Task-owned Sandbox itself is not the anchor
holder. Observer enrollment was not reached at that head; the older 4608531d
preview refusal below remains separate evidence.

Core 4f45e242 qualification
passed all 3,008 Rust tests, including all sixteen original bundle regressions,
strict Clippy/build and the locked CLI job; twenty of twenty-one CI jobs passed.
Only Kind E2E failed, specifically at SRE core-schema-preparation during
the apply call after preview. Correction to the earlier report: immutable
4f45e242 fixture lines 163-167 show that --dry-run completed and preserved
the legacy grant UID/subjects; line 168 invokes apply without that flag.
This proves the bare-Sandbox recovery
tests, not the newly added Task-caller recovery or observer Rust/API tests.
Those have since passed Rust execution at 7dad5417 as recorded above.
The active-SRE migration is now source-reviewed and composed in this candidate,
but still needs native execution.

Latest completed preceding head 4608531d:

• Bridge CI 34659784217
  passed all eleven jobs, including actual Rust and web execution.
• Native 34659784182
  passed all three independent cold API/admission installs, actual CLI writer
  enrollment, sole/multi-workspace grant updates, negative authority cases and
  Team rebind identity/data/attestation continuity.
• Native runtime delivery still failed with fixed category
  source_or_grant:bundle_owner. Existing-runtime observer enrollment failed
  during genuine CLI preview. Downstream TLS/CNI/rotation/revocation cases remain
  blocked, not passed.

The merged evaluator integration tip b5ad6791 separately reached 173 passing
Kind cases and one governed-service authentication/scope failure in
34660364941.
Its SRE and budget lifecycle cases passed. This merge-tip failure is retained and
being investigated; earlier PR-head success does not substitute for it.

Historical failed runs and their artifacts remain evidence; no failure,
cancellation or blocked case is relabeled as success.

Remaining blockers and permanent safeguards

• feat(credentials): add governed grants and purpose-limited observations #554: exact-head installer/runtime qualification and remaining
  historical schema migration. Source review closes four installer defects,
  but safe refusal of an unsupported upgrade is not functional compatibility.
• Credential-bundle lifecycle and supported UID-preserving observer enrollment,
  followed by actual native TLS/CNI/rotation/uninstall/revocation acceptance.
• Attribution: existing non-Microsoft notices must not be reassigned merely to
  satisfy the current header gate.
• Fresh full-scope source review/audit. The evaluator's separately qualified
  approval does not approve the credentials or complete Bridge application.
• Genuine standing-Team execution and authenticated governed delivery, with
  linked agent/run/artifact/deliverable/PR evidence and review/revision/authorized
  merge. Controlled native fixtures and imported UI are not this product proof.
• Activate permanent required component/native aggregate checks after their
  workflows are qualified. Existing fail-closed scope classification covers
  core, Bridge and shared CLI/runtime/dependency surfaces; core Rust/CLI/Kind
  checkouts physically omit Bridge. Missing or unexpectedly skipped required
  lanes cannot satisfy the aggregates.

Receipt trust, versioned remediation identity and narrow standard-crypto/legacy
compatibility adapters have focused fixes and prior hosted execution; no broad
crypto or unfinished-code exemption was introduced.

No main promotion, release/tag publication, registry push, H100/customer
deployment or private-repository visibility change is authorized by this PR.