feat(wake): W7 A10 idempotent installer + mosaic-wake.service (component-manifest, Gate-A, blank-reset retire, snapshot-guard, fail-closed install-validate) (#911)

Co-authored-by: jason.woltje <[email protected]>
Co-committed-by: jason.woltje <[email protected]>

packages/mosaic/framework/tools/wake/manifest.txt

@@ -17,8 +17,15 @@
 #   0.4.0  W5 — synthetic-canary FN-oracle + source-parity reconciler.
 #   0.5.0  W6 — off-host dead-man beacon emitter + pluggable alarm-sink adapter
 #              + beacon-absence alarm (fail-loud on unconfigured/unreachable).
+#   0.6.0  W7 — A10 idempotent, fail-closed component installer (Gate-A
+#              intersect+validate against the framework-manifest SSOT), the
+#              mosaic-wake.service detector daemon, the blank-reset retire idiom
+#              for the legacy heartbeat timer + snapshot-guard, and fail-closed
+#              alarm-target/HMAC-key install-validation. Also folds in the two W6
+#              monitor-integration observations (monitor-side ingested_ts
+#              staleness + beacon HMAC-verify at record).
 component=wake
-version=0.5.0
+version=0.6.0
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -58,5 +65,15 @@ schema_max=1
 #                    A same-host sibling is REJECTED as non-independent; an
 #                    isolated host degrades to a FLAGGED different-supervision-root
 #                    beacon; capture-pane is a liveness HINT only.            (W6)
-# Out of scope (later waves): installer (W7 wires + install-validates the beacon
-# target that beacon.sh's fail-loud primitive is designed for).
+#   wake-install.sh A10 — idempotent, fail-closed COMPONENT installer. Selects the
+#                    component file set and INTERSECTS-AND-VALIDATES it against the
+#                    single SSOT framework-manifest.txt (Gate A) — this VERSION
+#                    manifest authorizes no path. Ships the blank-reset retire
+#                    idiom (exactly-one OnUnitActiveUSec) for the legacy heartbeat
+#                    timer, the snapshot-guard (no reap without a snapshot), and
+#                    fail-closed alarm-target + HMAC-key install-validation (the
+#                    installer wires + install-validates the beacon target that
+#                    beacon.sh's fail-loud primitive is designed for).           (W7)
+# Companion (framework subtree, not under tools/wake/): systemd/user/mosaic-wake.service
+#                    — the long-lived detector daemon unit (per-class SLO lives in
+#                    the daemon, NOT a systemd interval).                          (W7)