test(DEN-2877): disposable Zed and gitlink dependent canary

[ORESoftware]

Disposable canary — do not merge

This draft PR is the dependent half of the nightly reconciliation graph test.

It references zed-pkg-test/java-lib#2 at exact head c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd through two independent graph mechanisms:

• .zpkg.toml: "zed-pkg-test/java-lib" = "^0.1.1";
• .gitmodules plus a real mode-160000 gitlink at vendor/java-lib pinned to the exact dependency PR head.

test-plan.json, source-pins.json, and the canary manifest also record the same dependency repository, branch, PR, and SHA.

Expected reconciler behavior:

1. discover java-lib#2 as an open dependency PR;
2. discover this PR as its dependent through both Zed and git-submodule graphs;
3. recompute this PR when the dependency head changes;
4. semantically update the pin and related evidence rather than choosing one side of a conflict;
5. never merge either PR because both are drafts and explicitly merge_forbidden disposable canaries.

Base: 59ea6f7473edfc6e8675fc7c2f7d7b0589611060
Exact dependent head: 912c119feb8bc87027f9b5a7e72c4dc5618c193a

Linear: DEN-2877, DEN-2876, DEN-801
Dependency canary: zed-pkg-test/java-lib#2
Source authority PR: https://github.com/ORESoftware/project-registry/pull/44

[linear-code]

DEN-2877

[ORESoftware]

{
"schema_version": "nightly_reconciliation_canary_ledger.v1",
"generated_at": "2026-08-08T19:53:18Z",
"mode": "dry-run",
"subject": "zed-pkg-test/java-app#2",
"evaluated_head_sha": "912c119feb8bc87027f9b5a7e72c4dc5618c193a",
"role": "dependent",
"dependency_context": {
"dependency": "zed-pkg-test/java-lib#2",
"dependency_head_sha": "c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd",
"zed_requirement": "^0.1.1",
"gitlink_path": "vendor/java-lib",
"gitlink_expected_sha": "c9fa3cb0b50bb39dc3cff005ef3640ae05d9ebfd",
"edges_required": [
"zed-package-dependency",
"mode-160000-gitlink"
]
},
"gates": {
"draft": true,
"merge_forbidden_fixture": true,
"dependency_head_bound": true,
"continuous_open_hours_at_least_55": false,
"signed_readiness_present": false,
"signed_critic_present": false,
"production_finalizer_enabled": false
},
"authorized": false,
"merge_attempted": false,
"mutations": [],
"blockers": [
"draft-pull-request",
"merge-forbidden-test-fixture",
"continuous-open-age-below-55-hours",
"missing-independent-readiness-attestation",
"missing-independent-critic-attestation",
"trusted-finalizer-not-enabled"
],
"next_gate": "Recompute this dependent when the dependency head or graph changes; never merge this fixture."
}

The dry-run recognizes both the Zed edge and the exact gitlink edge. It authorizes no mutation or merge.