S27: TeployAdapter behind SHIP_DEPLOY_ADAPTER=teploy (default off)

[im-tyler]

Changes

• src/teploy-adapter.ts: TeployAdapter implements DeploymentAdapter over the same argv runner and commands delivery.ts uses (status --json, deploy --image --version --skip-dns-check, rollback --to, exec ... docker image inspect). Bound to one service@destination; status.app must match or the answer is unknown. Ship-host file lease (fencing: lease). capabilities().unsupported (new optional field in deployment-adapter.ts) declares: destination fence vs manual teploy deploy, provider dry-run, target generation token, recovery artifact digest, logs, provisioning, other recovery modes.
• src/delivery.ts: optional adapter factory on executeDelivery and executeDeliveryRollback. Absent means the legacy code runs unchanged. Present: preconditions/build stay shared; only the deploy command and rollback go through the adapter journey. Record states unchanged (acted -> unknown, not acted -> held); the legacy sweep still confirms.
• src/worker.ts: passes the factory only when SHIP_DEPLOY_ADAPTER=teploy.
• src/fixtures/fake-teploy.mjs: fake CLI (real child process) with unreadable status, wrong service, hidden artifact, ID-form images, racing rival, failing deploy.

Checks

• lint clean; root suite 2107 pass / 0 fail (28 new). Grader-sensitivity and pj-b grader skipped (fixed port 8901); scripts/web untouched and not run.
• 27-check conformance suite: 22 pass, 5 skipped (deploy-fenced-on-generation, journey-refuses-stale-plan, logs-attribute-service, observe-attributes-service, no-readback-never-confirms), 0 fail. Skips tie to declared gaps.
• Default-off: explicit test that omitted and adapter: undefined give identical records, the legacy argv and a single status read, and no lease dir.
• Negative controls (mutate, watch fail, restore): 10 mutations all caught (no app attribution, unreadable-as-absent, nonzero-exit=rejected, non-exclusive lease, no pre-command compare, argv drift, any recovery mode, falsely declaring CAS, held-only-when-not-acted, skipped already-recovered check).

Not verified / still open

• No real teploy binary was run; fake CLI shape follows the live capture in delivery.test.ts. teploy logs flags unverified, so logs undeclared.
• Declared gap pinned by a test: a rival landing inside the deploy command is overwritten (no destination fence). Lease is Ship-host local.
• Adapter path is stricter than legacy: unreadable status (including a brand-new destination with no deployment) holds instead of proceeding.
• readBackDelivery/reconcileStaleRollback not moved to the adapter.
• Upstream requests (not filed here): teploy deploy --dry-run; status --json exposing a deploy generation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VqsBNqvaWezf1DwQrAnVgX

---

Generated by Claude Code