feat(deploy): add Engine ontology SDK transition

infra/deploy-runner/build-engine-agent-full-grant-migration-artifact.mjs

@@ -16,6 +16,12 @@ const storeRelativePath = 'nodedc-source/server/engineAgents/store.js'
 const predecessorSha256 = '52daa43499d6d9a97fe7ffa891edb9212b7791e733f91dd3ca686d42739b7e9a'
 const targetSha256 = '2e62654c2dc12905efcc83a9dff45a818dd7b47924a10600160835c4416540e9'
 const readerExtendedSourceSha256 = 'debd351fe0b8c72b33b8c79909b8f339cbaf061b970576f3ae72df52ebaa211f'
+const ontologyExtendedSourceSha256 = '4cd4bdd5958cfafee184e98a04fe12aa0c1cbe884326beaec63c99f9fff61285'
+const frozenTargetArtifact = join(
+  workspaceRoot,
+  'deploy-artifacts/nodedc-engine-agent-full-grant-migration-20260717-002.tgz',
+)
+const frozenTargetArtifactSha256 = 'd104ee6e63d1fccb9069e2b3db5e0446907ee9bf9cb04f2387636c272f803d68'
 const previouslyIssuedPatchIds = new Set([
   'engine-agent-full-grant-migration-20260717-001',
 ])
@@ -30,7 +36,7 @@ if (previouslyIssuedPatchIds.has(patchId)) {
 const source = join(engineRoot, storeRelativePath)
 const sourceInfo = await lstat(source)
 if (sourceInfo.isSymbolicLink() || !sourceInfo.isFile()) throw new Error('engine_agent_store_source_unsafe')
-const sourceBytes = materializeFrozenTarget(await readFile(source))
+const sourceBytes = await materializeFrozenTarget(await readFile(source))
 if (digest(sourceBytes) !== targetSha256) throw new Error('engine_agent_store_target_sha256_mismatch')
 const sourceText = sourceBytes.toString('utf8')
 for (const required of [
@@ -121,9 +127,28 @@ function digest(bytes) {
   return createHash('sha256').update(bytes).digest('hex')
 }
 
-function materializeFrozenTarget(bytes) {
+async function materializeFrozenTarget(bytes) {
   const sourceSha256 = digest(bytes)
   if (sourceSha256 === targetSha256) return bytes
+  if (sourceSha256 === ontologyExtendedSourceSha256) {
+    const artifactBytes = await readFile(frozenTargetArtifact)
+    if (digest(artifactBytes) !== frozenTargetArtifactSha256) {
+      throw new Error('engine_agent_store_frozen_target_artifact_sha256_mismatch')
+    }
+    const script = [
+      'import pathlib,sys,tarfile',
+      'p=pathlib.Path(sys.argv[1])',
+      "with tarfile.open(p,'r:gz') as t:",
+      " f=t.extractfile('payload/nodedc-source/server/engineAgents/store.js')",
+      " if f is None: raise SystemExit('member-unreadable')",
+      ' sys.stdout.buffer.write(f.read())',
+    ].join('\n')
+    const frozen = Buffer.from(run('python3', ['-c', script, frozenTargetArtifact]).stdout, 'utf8')
+    if (digest(frozen) !== targetSha256) {
+      throw new Error('engine_agent_store_frozen_target_sha256_mismatch')
+    }
+    return frozen
+  }
   if (sourceSha256 !== readerExtendedSourceSha256) {
     throw new Error('engine_agent_store_target_sha256_mismatch')
   }