feat(fleet): add generation-guarded agent CRUD (#773)

packages/mosaic/src/fleet/generated-env-boundary.ts

@@ -17,6 +17,12 @@ export interface AgentEnvironmentProjectionOptions {
   readonly generated: Readonly<Record<string, string>>;
 }
 
+export interface AgentGeneratedProjectionDeletionOptions {
+  readonly mosaicHome: string;
+  readonly agentEnvDir: string;
+  readonly agentName: string;
+}
+
 export interface AgentEnvironmentProjectionResult {
   readonly generatedPath: string;
   readonly localPath: string;
@@ -185,6 +191,23 @@ export async function prepareAgentEnvironmentProjection(
   };
 }
 
+/**
+ * Validates only the exact generated projection eligible for a roster delete.
+ * Local overrides, legacy input, and quarantine records are operator-retained and
+ * intentionally excluded from delete validation and cleanup.
+ */
+export async function prepareAgentGeneratedProjectionDeletion(
+  options: AgentGeneratedProjectionDeletionOptions,
+): Promise<string> {
+  if (!AGENT_NAME.test(options.agentName)) {
+    throw new AgentEnvBoundaryError('unsafe-agent-name', 'MOSAIC_AGENT_NAME', options.agentName);
+  }
+  await validatePrivateProjectionDirectory(options.mosaicHome, options.agentEnvDir);
+  const generatedPath = join(options.agentEnvDir, `${options.agentName}.env.generated`);
+  await assertPrivateRegularFileIfPresent(generatedPath);
+  return generatedPath;
+}
+
 /** Applies a previously prepared deterministic projection. */
 export async function applyPreparedAgentEnvironmentProjection(
   prepared: PreparedAgentEnvironmentProjection,