fix(talos): preserve verifier resource IDs in live observations - #5507

🤖 Generated by the Agentic Engineer

Validation at 4e67afb2e913932e39ed7a287b351c73463a6f29:

• A new parser test failed before implementation. With the parser present but the old observer unchanged, the full fixture suite still failed on the native zero-prefixed ID case. Both now pass, together with the Go race suite, ShellCheck, whitespace validation, and the workflow's one control plus twenty ablations.
• The observer retains complete rule decisions and rejects malformed streams or duplicate IDs before emitting any result. Existing changed-signer, action, ordering, missing-rule, ownership, lifecycle, trust-root, and fleet-churn controls remain active.
• User evaluation ran the proposed observer read-only against the live fleet with the pinned Talos client: the complete live fleet matched every declared ordered decision and held a running trust root. This observes materialized verification rules; the separate unsigned-image refusal proof is outside this change.

CodeRabbit's included review window is currently unavailable, as confirmed by its refusal on #5505 at 10:50:55 UTC; no paid review is being requested. The next available review lane will be used.

🤖 Generated by the Agentic Engineer

@codex review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 4e67afb2e9

🤖 Generated by the Agentic Engineer

The failed manifest-regression job is classified: the first native snapshot readback fixture hit HTTP 502 while pulling its pinned public tooling image. The remaining five cases using that same image then passed, including the matching-byte control. This is a transient image-delivery failure, not a verifier finding. Once the workflow settles, I will retry only its failed jobs once at this unchanged head; the native proof remains required.

🤖 Generated by the Agentic Engineer

The complete CI result also exposed a missing Talos upgrade-checklist entry for the new version-specific fixture. Commit 2cb6e1bd591a63da92787d2ba48619db8ec35673 adds that review obligation, and the local checklist regression now passes with all its refusal controls. The observer implementation is unchanged from the tested fleet exercise. The old workflow will not be retried; the new commit runs the complete checks and needs its own review.

🤖 Generated by the Agentic Engineer

@codex review

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 2cb6e1bd59

🤖 Generated by the Agentic Engineer

Ready for protected delivery at 2cb6e1bd591a63da92787d2ba48619db8ec35673: all 53 reported checks are settled without failures; every readable required gate passes; the branch is CLEAN; there are no review threads or unresolved body findings. Codex's clean receipt 6467667858 binds this commit. The observer implementation exercised against the complete fleet is unchanged; the follow-up adds the required upgrade-review entry.

The configured code-quality rule has no readable per-head result and remains UNVERIFIED in the completeness helper. The normal protected merge API must decide it; no override or complete-gate claim is being made.