feat(zeroshot-rust): implement terminal run resubmit

[tomdps]

Parent

• feat(zeroshot-rust): implement frontier-safe manual retry #685 — feat(zeroshot-rust): implement retry, resubmit, and delete lifecycle

Execution

AFK. Start only after every issue in Blocked by is merged, required CI is green for the resulting dev SHA, and the worktree is created from a freshly fetched origin/dev.

Outcome

Implement native terminal run resubmit using the merged protocol method, durable ledger authority, workspace/input provenance, and coordinator.

Authoritative contracts/current state

#746 owns public semantics. #754 owns dispatch/recovery and #697 owns admitted native state. Resubmit must not read providers/config/source or carry any runtime/session handle across runs.

Owned scope

• Validate terminal/run/generation/idempotency eligibility in one ClusterLedger CAS and allocate a new run/cursor at the same graph generation.
• Preserve prior history, admitted graph/IR/manifest/policy, and either exact durable seed or an already-resolved/revalidated replacement value with bounded provenance.
• Allocate new execution/workspace identities and a new immutable graph deadline; no provider session—including NodeInstance—carries over.
• Commit mutation/dispatch intent atomically and project the unchanged feat(cluster-protocol): add terminal run resubmit #746 result through NativeBackend.

Acceptance criteria

• Response loss and equal keys replay one receipt; stale/conflicting requests create no run.
• Prior run stays terminal and watchable while the new run has independent cursor/execution identity.
• Replacement input is accepted only with exact admitted type and verified provenance; lifecycle code performs no I/O resolution.
• Restart at every commit boundary reconstructs one resubmit and at most one dispatch.

Verification

cargo test -p zeroshot-rust --test lifecycle_resubmit
cargo test -p openengine-cluster-testkit
npm run rust:check
npm run protocol:check
npm run typecheck
npm run lint
npm run test:unit
opcore check --changed

Every named focused target is an issue-owned deliverable and must execute non-zero tests before the common gates.

Non-goals

• Protocol resubmit semantics.
• Task/source/config/provider resolution.
• Automatic retry or session resurrection.

Blocked by

• feat(cluster-protocol): add terminal run resubmit #746 — feat(cluster-protocol): add terminal run resubmit
• feat(zeroshot-rust): coordinate full-v1 dispatch, recovery, and settlement #754 — feat(zeroshot-rust): coordinate full-v1 dispatch, recovery, and settlement
• feat(zeroshot-rust): add durable workspace leases and isolation adapters #677 — feat(zeroshot-rust): add recoverable Borrowed, Worktree, and Docker workspaces
• feat(zeroshot-rust): project the native ledger into durable protocol watch #678 — feat(zeroshot-rust): implement ledger-backed durable watch and reconnect
• feat(zeroshot-rust): implement native plan/apply/get admission #697 — feat(zeroshot-rust): implement native plan/apply/get admission

Unblocks

• feat(zeroshot-rust): add the native foreground run CLI #687 — feat(zeroshot-rust): add the native CLI over the local daemon
• feat(zeroshot-rust): compose the production NativeBackend factory #774 — feat(zeroshot-rust): compose the production NativeBackend factory