Add a software-delivery Flow composition helper

[bigboateng]

Summary

• add the pure softwareDelivery composition helper while keeping defineFlow as the sole raw-IR lowering boundary
• derive only canonical facets, evidence, trusted operators and transitions, resolver declarations, and explicit work bindings from repository-owned policy
• add typed validation, immutability coverage, restricted-frontend conformance, and production compiler evidence
• prove byte-identical raw IR, canonical programs, ProgramFingerprint, and Codex/Claude/Cursor/Gemini projections against a manually assembled fixture
• migrate the canonical example and documentation and add an append-only release note
• require the software-delivery behavioral and conformance suites in the PR flow-sdk job

Verification

• npm run test:flow-sdk (16/16)
• npm run docs:check
• python3 .github/scripts/run_go_tests.py (543 tests across 10 shards)
• go test -race ./..., go vet ./..., go build ./...
• repository Python tests (55 pass, 1 expected failure)
• release-note validation and git diff --check
• exact-head required CI on Linux, macOS, and all six Windows shards
• two completed Codex review/fix/verification cycles; both actionable threads resolved
• Locus exact-head model faithful; hidden-control safety verdict satisfied; event-completeness discharged
• consumer proof through actual Cursor Computer Use: Upgrade delivery Flow and add task search bigboateng/boatstack-test#15

No schema, compiler revision, kernel, transition catalog, host-admission rule, projection-selection rule, or Locus artifact changed.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.99

The new helper advertises and tests additional work composition, but its output is deterministically rejected by the production compiler. Model-level verification is not recommended before merge; this is a direct helper/compiler contract failure.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.92

The composition logic appears consistent with the prior manual wiring, but its newly added behavioral and conformance suites are not executed by CI. Model-level verification is not recommended for this helper-only change.