…transitions

Adds the listener that writes a chain event for every transition
through the OperationalStateHolder. PM-verified vocabulary against
foundation/0159_kora_r41_operational_state_event_vocabulary.sql on
isokron-prod (2026-05-21):

  * ALWAYS emit ``kora.operational_state.transitioned`` — single
    generic edge event per substrate-team design. Payload carries
    from/to primary_state, new claim_permission, sorted
    degradation_reasons, and trigger.
  * ADDITIONALLY emit when a per-trigger literal exists:
      - (BOOTING → READY, "all §9.2 gates pass") → kora.boot.ready
      - (BOOTING → STOPPED, "invariant gate failure …") →
        kora.boot.failed
      - (any → PAUSED, trigger contains "cost 100%") →
        kora.paused.cost_limit
  * Operator-pause and substrate-pause: only the generic event.
    Per-trigger literals can land in a follow-on substrate vocab
    migration if cockpit needs the signal.

Fail-LOUD: preflight failures (missing provider / connection /
workspace_id) and substrate-side raises both surface as
OperationalStateEmitError. The state-machine listener-error
handler logs but doesn't roll back — listeners are observability,
not policy — so a broken emit is loudly logged but the state
machine keeps moving.

agent/operational_state_emit.py exposes:
  - GENERIC_TRANSITION_EVENT, BOOT_READY_EVENT, BOOT_FAILED_EVENT,
    PAUSED_COST_LIMIT_EVENT — constants matched against
    foundation/0159
  - emit_state_transition(provider, from, to, trigger) — async
    callable, fail-LOUD
  - make_emit_listener(provider) — factory returning a
    StateTransitionListener; ST3 wires this into the holder at
    provider init

Tests (tests/test_operational_state_emit.py): 16 cases covering
payload shape, per-trigger literal selection (incl. lenient
substring match for varied caller wording), the BOOTING → STOPPED
disambiguation (invariant-failure vs STOP-KORA L4/L5), fail-LOUD
preflight (None provider, missing connection, workspace_id raise
or empty), generic-plus-extra dual-emit, substrate-failure
propagation, and the make_emit_listener factory.

Builds on ST1 (#32). ST3 will land the wire-in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…tate holder

agent/operational_state_wire.py (new): wire_operational_state(provider)
is the one boot-time call that:

  1. init_holder(OperationalState(primary_state=BOOTING,
     claim_permission=NONE)) — module-level singleton, idempotent.
  2. holder.add_listener(make_emit_listener(provider)) — registers
     the chain-event listener from ST2.
  3. Triggers BOOTING → READY via the connection's submit_and_wait
     (agent_init.py is synchronous; we run the coro on the IsoKron
     dedicated IO loop and block boot until the emit listener returns).

Per spec §3 ST3: the transition is UNCONDITIONAL in v1. KR-P2-H
follow-on adds the §9.2 invariant-gate-check guard that decides
whether to transition READY or fall through to STOPPED — that
bucket is blocked on substrate-round Bucket C event vocab and
ships later.

Fail-soft posture: every error here is caught + logged with the
greppable [kora.operational_state.wire_in] tag. Operator boot
proceeds even if holder construction or emit raises — only the
observability surface is degraded. KR-P2-H will revisit which
failures should block boot.

agent/agent_init.py: after agent._memory_manager.initialize_all
succeeds, look up the IsoKron provider and call
wire_operational_state(provider). Wrapped in a defensive
try/except so a wire-in module-import failure also doesn't break
boot.

Tests (tests/test_operational_state_wire.py): 4 cases covering
the happy path (holder in READY + generic + boot.ready emits with
the canonical "all §9.2 gates pass" trigger), the no-connection
branch (holder created in BOOTING + greppable WARNING), the
submit-raises branch (wire-in stays fail-soft + WARNING), and
idempotence (second call with second listener doubles the per-
transition emit but state stays at READY).

Stacked on top of ST1 (#32) + ST2 (#33). ST4 wires SeaTicketPoller
claim/release (depends on KR-P2-E ST1 merged), ST5 flips the
/api/operational-state endpoint from stub to read get_holder().

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>