feat(apps): add v0.58 repository profiler and compatibility classifier

[MichaelWave369]

Purpose

Introduce PhiOS App Platform v0.58: a bounded repository profiler and compatibility classifier for public GitHub repositories.

The runtime/toolchain spine through v0.57 is now strong enough to pivot back to the user-facing goal:

GitHub URL
  -> profile
  -> exact compatibility class
  -> exact next gate or remediation

The central rule is:

compatible != acquired
compatible != built
compatible != installed
compatible != runnable

New contracts

• phios.repo_profile.v0.1
• phios.repo_compatibility.v0.1

What this PR adds

• deterministic profile generation from the existing bounded v0.26 intake result;
• exact head-SHA binding;
• declared / inferred / absent manifest classification;
• manifest/proposal license expression plus GitHub-reported SPDX evidence;
• first acceptance policy:
  • license_policy = mit_only;
• MIT-family evidence held unless manifest/proposal and GitHub SPDX evidence agree;
• deterministic build-family classification:
  • static web;
  • Node/npm;
  • Node/pnpm;
  • Node/Yarn;
  • Node/Bun;
  • unlocked Node;
  • Python/PEP 517;
  • Rust/Cargo;
  • Go modules;
  • unknown;
• root-marker observation for:
  • .gitmodules;
  • .gitattributes;
  • .lfsconfig;
• compatibility statuses:
  • SUPPORTED_AFTER_OPERATOR_APPROVAL
  • REPOSITORY_DISABLED
  • ARCHIVED_REPOSITORY_REVIEW
  • NOT_AN_APPLICATION
  • MANIFEST_REVIEW_REQUIRED
  • LICENSE_REVIEW_REQUIRED
  • SUBMODULE_REQUIRED
  • LFS_REVIEW_REQUIRED
  • MISSING_TOOLCHAIN
  • LOCKFILE_REQUIRED
  • UNSUPPORTED_RUNTIME
• strict canonical serialization and SHA-256 tamper checks;
• explicit zero-authority fields;
• new operator command:

phi-app profile-github https://github.com/OWNER/REPO

Conservative decisions

Git LFS

A root .gitattributes or .lfsconfig marker triggers LFS_REVIEW_REQUIRED.

This does not claim that Git LFS is definitely used. It prevents PhiOS from claiming a
complete ordinary-source path before bounded attribute/LFS evidence exists.

Submodules

A root .gitmodules marker triggers SUBMODULE_REQUIRED, because current v0.27 exact
GitHub ZIP acquisition does not recursively acquire submodule content.

Native apps

Rust/Go build families are recognized, but current installed-app runtime support does not
launch native artifacts. They therefore report UNSUPPORTED_RUNTIME.

Python

An inferred pyproject.toml does not identify the direct .py entrypoint required by
the current Python runtime adapter. A declared phios-app.json with an explicit Python
file target can pass the v0.58 profile gate.

Source size

v0.58 does not guess whether a repository fits v0.27 from approximate GitHub repository
size metadata. Exact acquisition bounds remain authoritative.

Authority semantics

Every profile and compatibility result grants:

acquisition_authority = false
build_authority = false
install_authority = false
launch_authority = false

The compatibility assessment is advisory-only.

SUPPORTED_AFTER_OPERATOR_APPROVAL means only that v0.58 observed no current profile
blocker. Every later governed gate still applies.

Next rung

v0.59 should create an Install from GitHub proposal that binds one exact intake result
and one exact v0.58 profile/assessment to the proposed governed next stages.

A blocked v0.58 assessment should stop immediately with its remediation instead of
creating acquisition authority.

Qualification

Run the normal PhiOS CI surface and preserve every failure exactly.

[MichaelWave369]

Oct 11 rescue of this original PR

Updated original PR branch, no duplicate PR or force-push. Added merge commit 0151bdbf390c45a14afbd8b327ab7dca6832415d with green PhiOS main d0529dc34a15d787ebcd3e771cd24daa4f5d8e25 as a parent, preserving this PR's full history. All previously modified main files were verified unchanged from the original Oct 5 base; the refreshed tree contains current main plus only this PR's six intended files. Fixed the exact October 5 test failure: the archived-repository compatibility blocker now states archived=true: explicit operator review is required before acquisition; authority remains advisory-only. GitHub now reports mergeable=true. Full updated qualification currently running. Do not merge until ALL jobs succeed and founder review; profiler compatibility does not permit acquisition, installation or execution.

[MichaelWave369]

Post-merge CI analysis, October 11 (Pacific)

Merged successfully as current main 558bae83c32813fdeb3ded02414a21aa9708c2ed, with #305 as first parent. The PR-head qualification had fully SUCCESS (38198138648), and all six current post-merge software qualification jobs (Python tests/types, PhiShell, ledger, installed artifact etc.) are SUCCESS. The production normal-image on 38199603238 is also SUCCESS. QA development qa-image failed on attempt 1 while fetching signed pcre2-10.49-1-x86_64.pkg.tar.zst.sig from the exact pinned archive.archlinux.org snapshot (pacman: Operation too slow ... last 10 seconds). This is an external package-archive transfer failure, not a profiler assertion failure. A targeted rerun of failed jobs on this same commit was requested, attempt 2, with no code or signature-policy bypass. Hold release certification until rerun QA and the aggregate release gate finish green.