#28446 PlatformMachines: fence lifecycle retries and expose provider calls

PlatformMachines currently exposes only the environment runner's narrow interface. The Freestyle MachineProvider in manaflow-ai/cmux-platform#20 needs atomic machine metadata, memory pause/resume, fork, and shape selection. This additive extension exposes versioned provider discovery plus create/get/shape/pause/resume/fork RPCs while preserving boot/find/exec/snapshot/destroy.

The follow-up fixes the exact-head review findings from the superseded #27063: membership is rechecked after fork capture and before restore/final completion, with captured snapshots retired on refusal; disabled PlatformMachines fences pending ordinary starts using confirmed memory-preserving pause; and expired/revoked/error create, resize, and fork intents are fenced before CloudDO's base retry pass. Regression tests cover revoked capture, disabled resume compensation beyond retry caps, and expiry fencing. No real cloud machines are created by tests.

Dependency: #26939 is on feat-cmux-next. Consumer: cmux-platform#20. This PR supersedes closed #27063 because its prior head was closed before these fixes could land.

Size: 1,028 changed lines. The RPC extension, durable continuation, and crash/cost regressions form one correctness change; splitting would expose incomplete fork or shape behavior.

Validation

• git diff --check and prepush gate pass.
• Backend workflow must run with its normal Bun 1.4.4 and Node 24 setup; the earlier setup-none fast check (40780894396) was invalid because bun was unavailable and is not evidence.
• Focused validation passed: https://github.com/manaflow-ai/cmux/actions/runs/41104311115 (Bun 1.4.4 install, API typecheck, and platform-machines.test.ts).

Leo, 2026-10-28:

"We need to auto scale. We need to be like Versa. Is to AWS. Like we need to be that to Freestyle, to like whatever f***ing cloud provider, whatever machines that we have. We need to just get after it."

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the provider lifecycle calls to PlatformMachines and fences their retries so disabled, expired, or revoked intents never allocate, leak, or resume a machine.

The extension adds providerInfo, create, get, shape, pause, resume, and fork RPCs on top of the existing boot/find/exec/snapshot/destroy calls. Create and fork requests run through a durable continuation journal so committed intents survive lost replies, and the provider is only reported available where PLATFORM_MACHINES is on in development/test; after disabling it, find and destroy stay for cleanup and create/fork only recover existing intent IDs.

Lifecycle fencing

• Disabling the provider cancels pending creates and resizes before CloudDO's base retry can allocate or grow capacity, and compensates pending resumes with a confirmed memory pause that persists beyond the ordinary retry caps.
• Membership is rechecked after fork capture and before restore; expired, revoked, or failed create, resize, and fork intents are fenced before base retries, and captured snapshots are retired once the child settles.
• Create and fork while disabled or after a lost reply recover the committed intent instead of starting new work; provider capacity is only reported as confirmed shape, and a failed resource read keeps the machine in starting.
• Environment cleanup rows keep their scheduled backoff path rather than a fast lane, so fenced platform work never starves build cleanup.
• Tests cover revoked capture, disabled resume compensation, expiry and resize fencing, lost-reply recovery, and same-name races without creating real VMs.