feat(handoffs): publish owner task interfaces

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

interfaces/zone-engine-workload-resolution-v1.yaml

@@ -0,0 +1,49 @@
+apiVersion: helixforge.repo-manager/v1
+kind: OwnerTaskInterface
+metadata:
+  id: helixforge.workloads.zone-engine-resolution.v1
+  title: Consume explicit workload references without inference
+source:
+  repo: repo-manager
+  workplan_task: RMGR-WP-0010-T07
+target:
+  repo: zone-engine
+  owner_agent: zone-engine
+  suggested_work_record: ZONE-WP-0001-T07
+approval:
+  dispositions: [approved, amended, rejected]
+  record_in: ZONE-WP-0001-T07 or a Zone Engine owner decision
+task:
+  title: Prove Zone Engine workload resolution without inference
+  priority: high
+  objective: >-
+    Join ops-warden lane pointers to authoritative Repo Manager workload
+    projections and expose unresolved workload identity without guessing.
+  inputs:
+    - ref: repo-manager/docs/workload-reference-contract_v1.md
+      authority: repo-manager
+    - ref: helixforge.workloads.ops-warden-reference.v1
+      authority: ops-warden after approval
+    - ref: zone-engine/docs/security-zones_v0.1.md
+      authority: zone-engine draft pending canon adoption
+  deliverables:
+    - Consume exact rapp_id and workload name pairs plus optional deployable.
+    - Preserve resolved, unknown, and owner-asserted not-applicable as distinct states.
+    - Join authoritative projection data to explicit catalog references only.
+    - Emit evidence that name and path drift cannot change zone membership.
+  constraints:
+    - Do not parse repository slugs, owner_repo, credential paths, or path templates as identity.
+    - Unknown must fail closed wherever zone policy requires workload identity.
+    - Zone Engine does not author workload identity or ops-warden lane pointers.
+  acceptance:
+    - A valid exact reference resolves to one authoritative workload projection.
+    - A mismatched qonto versus rapp-qonto name remains unknown.
+    - A non-workload lane remains not-applicable rather than becoming unknown.
+    - No fallback identity path exists in implementation or fixtures.
+  verification:
+    - >-
+      uv run --project /home/worsch/repo-manager rmgr workload resolve --root
+      /home/worsch --rapp-id rapp-issue-core --name issue-core --deployable issue-core
+    - >-
+      uv run --project /home/worsch/repo-manager rmgr workload resolve --root
+      /home/worsch --rapp-id rapp-qonto --name rapp-qonto