refactor(composition): unify capability bindings and cleanup ownership (#8441)

Bind typed service creation, observed availability and retryable cleanup in one composition owner. Reuse selected CLI/MCP factories and canonical contract groups without copying provider operation inventories.

Closes #8429. Refs #740.

Validated paired real application workflows, actual local Codex CLI Terra/high use, complete Evidence and Unknown checkpoint parity, compiler-backed import boundaries, SDK schemas and final real mixed routing. Automated review findings were fixed at their producing owners. Existing exact-base CodeQL alerts are documented on the PR under the owner-authorized unrelated-check exception; no global alerts or security rules were changed.

Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)

src/javascript/recovery/WakaruExecution.ts

@@ -25,7 +25,8 @@ import {
 } from "./WakaruCommand.js";
 import { parseWakaruReports } from "./WakaruReport.js";
 import { publishWakaruArtifacts } from "./WakaruPublication.js";
-import { RECOVERY_LIMITS, WAKARU_PROVIDER_IDENTITY } from "./WakaruRelease.js";
+import { RECOVERY_LIMITS } from "./WakaruRelease.js";
+import { WAKARU_PROVIDER_IDENTITY } from "./WakaruProviderIdentity.js";
 import { admitWakaruVersion } from "./WakaruVersion.js";
 
 const OPERATION = "recover_javascript_sources";

src/javascript/recovery/WakaruProviderIdentity.ts

@@ -0,0 +1,13 @@
+/** Unchanged upstream source pin; executed bytes are identified separately. */
+export const WAKARU_RELEASE = {
+  version: "1.14.0",
+  revision: "8219bf5016a063d7fb215101a8c45d5959ec733f",
+  repository: "https://github.com/pionxzh/wakaru",
+} as const;
+
+/** Catalog identity for the verified Wakaru release. Evidence replaces version with the observed banner. */
+export const WAKARU_PROVIDER_IDENTITY = {
+  id: "wakaru",
+  name: "Wakaru",
+  version: WAKARU_RELEASE.version,
+} as const;

src/javascript/recovery/WakaruPublication.ts

@@ -18,11 +18,8 @@ import {
   validateRecoverySourceMap,
   type parseWakaruReports,
 } from "./WakaruReport.js";
-import {
-  RECOVERY_LIMITATIONS,
-  RECOVERY_LIMITS,
-  WAKARU_RELEASE,
-} from "./WakaruRelease.js";
+import { RECOVERY_LIMITATIONS, RECOVERY_LIMITS } from "./WakaruRelease.js";
+import { WAKARU_RELEASE } from "./WakaruProviderIdentity.js";
 import type {
   resolveWakaruCommand,
   runWakaruCommand,

src/javascript/recovery/WakaruRelease.ts

@@ -1,12 +1,5 @@
 import { BOUNDED_PRODUCER_LIMITS } from "../../process/LinuxResourceLimits.js";
 
-/** Unchanged upstream source pin; executed bytes are identified separately. */
-export const WAKARU_RELEASE = {
-  version: "1.14.0",
-  revision: "8219bf5016a063d7fb215101a8c45d5959ec733f",
-  repository: "https://github.com/pionxzh/wakaru",
-} as const;
-
 /**
  * Releases the report parser accepts. Wakaru changes `--version`, `--json`
  * and `provenance.json` only by addition within a major version
@@ -15,13 +8,6 @@ export const WAKARU_RELEASE = {
  */
 export const WAKARU_ACCEPTED_RANGE = "^1.13.0";
 
-/** Catalog identity for the verified Wakaru release. Evidence replaces version with the observed banner. */
-export const WAKARU_PROVIDER_IDENTITY = {
-  id: "wakaru",
-  name: "Wakaru",
-  version: WAKARU_RELEASE.version,
-} as const;
-
 /** Fixed Wakaru allowance. This release has no caller setting that raises it. */
 export const wakaruFixedLimitRecovery = (
   allowance: string,

src/javascript/recovery/WakaruVersion.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { admitWakaruVersion } from "./WakaruVersion.js";
-import { WAKARU_RELEASE } from "./WakaruRelease.js";
+import { WAKARU_RELEASE } from "./WakaruProviderIdentity.js";
 
 describe("Wakaru release range", () => {
   it("accepts the verified banner without an extra limitation", () => {

src/javascript/recovery/WakaruVersion.ts

@@ -1,5 +1,6 @@
 import { satisfies, valid } from "semver";
-import { WAKARU_ACCEPTED_RANGE, WAKARU_RELEASE } from "./WakaruRelease.js";
+import { WAKARU_ACCEPTED_RANGE } from "./WakaruRelease.js";
+import { WAKARU_RELEASE } from "./WakaruProviderIdentity.js";
 
 /** Admission of one observed `wakaru --version` banner. */
 export type WakaruVersionAdmission =