Inspect published Waterline before Nexus fixture teardown

[rmcdaniel]

Actual operator qualification

Refs durable-workflow/waterline#174. Add an optional published Waterline observer to the existing Nexus producer while its real published PHP/Python calls and isolated Server are still alive.

The observer requires an exact image digest, a supplied Waterline inspector and isolated Playwright tooling. Two read-only observers use the payload owner and caller namespaces. Published image version/source must match the selected Packagist source/dist. Inspection runs after the real workflows, before the existing Compose teardown removes the observers and their volumes.

Without observer inputs, the existing producer is unchanged. Partial/invalid selection fails before stack startup. No native implementation, shared PHP/Rust/embedded corpus or differential runner is changed. Coordination of their catalog contract stays with #325's owner.

Shell syntax, all four inline Node programs and the six existing false-execution evidence regressions pass. Actual published API/browser qualification is still pending the qualified Server #413 and Waterline #175 artifacts and the Waterline observer PR. A source syntax check or the prior routing flag cannot close #174 or make the full Nexus matrix passing.

[rmcdaniel]

Rust #325 coordination: #415 is qualifying #413 main 8709feb28f1b85853de1d9ad15152d961860926f with frozen prior signal tuple. Its all-six run 38174375337 is active; SDK prep/independent provenance pass, actual signal runtime qualification remains pending. Main landing remains held through your release window.

I have now read #414's single owning change to nexus-published-artifacts.sh. If it lands before signal qualification finishes, I will integrate the new main promptly, preserve any useful partial failure evidence, retire the superseded run and qualify the final combined source. No competing Nexus/Waterline changes or request to delay release follow-through. Please keep any remaining main landing needed for this release window visible here/#413 so the signal acceptance can use the final source without repeated full restarts.

[rmcdaniel]

Reviewed b1c1c5d against current main. The only change adds optional, digest-bound published Waterline observers to the existing producer. It retains normal execution when omitted, requires source agreement with Packagist, and runs inspection before the existing task-owned Compose teardown. Seven normal checks pass. Actual browser qualification remains pending the published Waterline artifact.