P-022 step 8: Rust-default cutover, rollback gate, and Python distribution removal

[PhysShell]

Parent: #250
Recommended tier: strong + owner decision
Blocked by: #260 and #261
Also depends on: #256 and #259

Goal

Make an explicit, evidence-backed decision to switch Owen's default engine from Python to Rust, preserve a tested rollback path, and only later remove Python as a distribution dependency.

This is not an implementation catch-all. It is a cutover gate with measurable correctness, reliability, distribution and performance requirements.

Staged rollout

Stage 1: opt-in Rust

• Python remains default.
• Rust engine is explicitly selectable.
• Compare mode is available.
• Dogfood and selected CI jobs exercise Rust.

Stage 2: repository CI/dogfood Rust default

• Rust is default in Own.NET's own CI and internal dogfood.
• Python remains an explicit fallback/reference mode.
• All compare gates continue to run.

Stage 3: public Rust default

• Owen public package/Action uses Rust by default.
• A documented escape hatch can select Python during the observation window.
• No silent fallback from Rust failure to Python success.

Stage 4: remove Python distribution dependency

Separate PR after an observation period:

• remove vendored Python core from the package;
• remove runtime Python discovery/download/cache requirements;
• deprecate/remove OWEN_PYTHON and legacy OWN_PYTHON according to a documented compatibility plan;
• retain Python reference code and oracle fixtures in the repository while they remain valuable for differential testing.

Correctness gates

• P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260 fast and broad compare matrices report zero unexplained differences.
• Five pinned OSS repositories report zero unexplained differences.
• Full diagnostic/message/Evidence/report/SARIF parity is green.
• CLI command/output/exit-code parity is green.
• No severity or diagnostic-count drift is accepted without a separate Python-first decision.

Reliability gates

• malformed OwnIR and malformed source inputs do not panic;
• Rust crashes are visible and produce reproduction artifacts;
• cancellation/interruption behavior is tested;
• deterministic reruns produce identical normalized output;
• memory/resource limits for hostile or very large inputs are documented;
• Windows and Linux clean-machine paths are covered.

Distribution gates

• Rust binary is packaged for all supported platforms;
• public Owen.Cli install and Action use work without undeclared runtimes;
• package upgrade/uninstall/reinstall tested;
• rollback engine selection is documented and tested during the observation stage;
• release workflow tests the actual packed artifact, not a project build.

Performance gates

Establish and publish baselines for:

• process startup;
• OwnIR parse;
• bridge/lowering;
• analysis;
• report/SARIF rendering;
• end-to-end C# project/solution run;
• peak RSS/allocations where practical.

Do not require a theatrical multiplier. Rust must meet an explicit budget and must not materially regress the user-visible path. Profile before optimizing; JSON and rendering may dominate once analysis becomes cheap.

Cutover decision packet

The PR/ADR must include:

Observation window:
Fast compare result:
Five-repo compare result:
Large-solution result:
Windows packaging result:
Linux packaging result:
Startup delta:
End-to-end delta:
Peak memory delta:
Known differences:
Rollback command/config:
Python-removal timing:

Rollback

• Rollback must be a documented engine selection or package patch, not a hidden automatic fallback.
• A Rust failure must remain observable.
• Immutable release tags are never moved.
• A broken release is corrected by a new patch release.

Guardrails

• No new diagnostics.
• No semantic cleanup mixed into cutover.
• No removal of Python reference/oracle tests merely because distribution no longer needs Python.
• No public Rust default before the evidence packet is approved.
• No Python dependency removal in the same PR that first changes the default.

Acceptance

• Explicit owner-approved cutover decision exists.
• Rust is public default only after all gates pass.
• Rollback path is tested and documented.
• Observation-period results are recorded.
• Python distribution removal occurs in a later, separately reviewable PR.
• Public Owen install/Action behavior remains correct on supported platforms.