Write a Project's first pin source when it first composes onto the estate path #232

Parent

#195

What to build

The first time a Project composes onto the estate path, composition writes its pin file, projects/<project>/source.yaml (spec/v1/55-delivery.md#rendered-artifacts-and-pins). The file holds an OCIRepository naming <repository>/<project> by ref.digest, verifying keyless against the Platform document's signer, and one Kustomization per Reconcile Unit of the Project applying its path. It is derived from the Platform document and the Reconcile Unit DAG, and afterwards only its ref.digest changes.

Today the worked compose workflow stops with "no source yet" when a moved Project has no source, rather than invent one.

Acceptance criteria

• composeEstate returns, for each delivered Project with no pin, the source file's objects: the OCIRepository and one Kustomization per Reconcile Unit, with dependsOn following the units' after.
• deploy-kit compose writes them under its output directory, and the worked compose workflow copies them into projects/ before it commits the pins.
• Every object validates against its pinned schema, the way npm run lint:manifests holds the rendered trees.
• Tested at the compose seam, with coverage and Stryker holding at 100.

Blocked by

• Compose the estate: a compose use-case and CLI, pin annotations and fragment versions #197