fix: harden write safety, ADT sessions, and result verification

[Augusto42]

Summary

This PR fixes ten independently reproduced defect groups across CLI safety, source-write result handling, installers, ADT stateful mutation sessions, activation workflows, recording history, and Windows test portability.

What changed

• propagate persistent safety flags and resolved safety configuration to every CLI/MCP client
• make Lua writeSource forward all supported options and return false with a diagnostic on logical failures
• require successful activation and a valid completion marker in ExecuteABAP; propagate logical failure through CLI/MCP
• verify package creation, deployment result, syntax, activation, and source read-back in installers
• keep CSRF discovery/refresh in the same stateful session as lock/write/unlock
• validate package scope before locking while continuing to enforce operation and transport policy
• preserve MODIFICATION_SUPPORT as metadata and reuse lock corrNr under the normal transport safety whitelist
• guarantee unique, time-sortable recording IDs even when the platform clock does not advance between calls
• use native temporary directories for the JavaScript oracle test on Windows
• make copy exit non-zero on failed objects, create packages only after a conclusive absence check, and skip unsupported or partial deployments before writing
• surface logical WriteSource and Activate failures as MCP tool errors
• stop deploy, table, batch, DSL, and rename workflows when activation reports success=false
• write renamed source to the source endpoint, require unlock and activation, and never delete the old object after an unsuccessful activation
• stop DeployFromFile before locking or writing when the existence probe is inconclusive

Root causes

The defects combined incomplete configuration propagation, logical failures being treated as transport success, inconclusive existence checks being treated as absence, and loss of session/transport context between ADT mutation requests. Some orchestration paths also advanced after unsuccessful activation or advertised deployment paths that were not implemented. Recording IDs relied on wall-clock resolution alone, causing rapid recordings to overwrite one another on Windows.

User impact

Write restrictions now apply consistently. Failed or partial writes, installations, executions, activations, copies, and renames are no longer reported as successful. Destructive rename does not touch the old object unless the replacement is written, unlocked, and activated. Stateful ADT edit flows retain their session and transport context without bypassing local safety gates.

Related issues and PRs

Refs #88, #92, #117, #141, #143, #144.
Overlaps with the intent of #106, #108, #120, #125, and #138 while retaining operation and transport validation after the package lookup is skipped.

Validation

• focused tests for cmd/vsp, pkg/config, pkg/scripting, pkg/adt, pkg/dsl, internal/install, and internal/mcp
• activation, rename, existence, copy, and MCP regressions passed 20 consecutive runs
• history regression group passed 50 consecutive runs
• pkg/jseval oracle comparison passes on Windows
• go vet ./...
• gofmt on every changed Go file
• golangci-lint v1.64.8 run --new-from-rev=origin/main ./...
• git diff origin/main..HEAD --check

The full go test ./... run passes for every package that does not require SQLite through CGO. The remaining failures are the existing cmd/vsp and pkg/cache SQLite tests under CGO_ENABLED=0.

All SAP-facing behavior is covered with mocks and synthetic fixtures; no live SAP system was contacted.