feat(runtime): add provider v1 protocol and graph provenance

[joeykchen]

Summary

This PR adds the goplus/mod language and contract layer for goplus/spx#1741. It defines runtime-provider metadata, resolved graph provenance, and the provider-neutral v1 request protocol.

This layer deliberately contains no XGo command dispatch or SPX-specific runtime policy.

What changed

• Add runtime <protocol> <provider-package> metadata scoped to the nearest preceding project, with strict protocol and import-path validation.
• Capture SHA-256 identities for the exact go.mod and gox.mod/gop.mod snapshots consumed during resolution.
• Represent resolved modules without flattening replacements: the MVS-selected identity remains separate from the source actually read.
• Add resolved class-graph import that consumes a caller-resolved graph, validates target and declaration snapshots, and attaches provenance and minimum-XGo metadata to class projects.
• Add the provider-neutral v1 request model and deterministic argv codec for run and transactional build.
• Validate graph/build policy, project and pack metadata, provider identity, application arguments, and action-specific output fields.
• Reject unknown, repeated, incomplete, malformed, and action-inapplicable protocol fields.

Compatibility and boundaries

The existing class import path remains available. Built-in projects remain provenance-free, and projects without runtime metadata keep their current behavior.

ResolvedClassGraph validates and consumes an effective graph supplied by XGo; it does not independently run MVS or resolve a second graph. Filesystem identity checks that require live provider inputs remain the provider's responsibility.

This is the first repository in the coordinated release order. XGo must update to the released goplus/mod version before runtime-provider support can be published.

Verification

• GOWORK=off go test -count=1 ./...
• GOWORK=off go vet ./...
• git diff --check

Part of goplus/spx#1741. Published SPX mode and the coordinated release remain follow-up work.

Companion PRs

• XGo dispatcher: goplus/xgo#2847
• SPX source-mode provider: goplus/spx#1742

[codecov]

Codecov Report

❌ Patch coverage is 94.01596% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.45%. Comparing base (f4300a7) to head (9fb832b).

Files with missing lines	Patch %	Lines
xgomod/resolved.go	89.55%	13 Missing and 13 partials ⚠️
xgomod/classfile.go	86.44%	8 Missing and 8 partials ⚠️
driverprotocol/protocol.go	98.62%	1 Missing and 1 partial ⚠️
modload/module.go	96.29%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #164      +/-   ##
==========================================
+ Coverage   81.34%   87.45%   +6.10%     
==========================================
  Files          10       13       +3     
  Lines         906     1650     +744     
==========================================
+ Hits          737     1443     +706     
- Misses        150      169      +19     
- Partials       19       38      +19     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.