[pournasserian]

Closes #2557

What

A third initiator kind for what the product does on its own, recorded as ADR-0012. It lands ahead of the check run on every change set (F-CHK #2420), which needs it, and routing's auto-publish (F-RTE) can reuse it.

• Core (FluentCMS.Core.Identity): SystemInitiator, named for its component: SystemInitiator.Checks and SystemInitiator.Retention. Its id is derived from the component, so one engine is named one way in every row.
• Audit:
  • InitiatorKinds.System (system). Rows store the component and its id, with no agent credential; the existing constraint (only agent rows carry a credential) holds.
  • A row whose id is not its component's is refused, as an unknown kind is.
  • The export shows initiatorKind system, and the audit screen badges it as System.
• Limits, in Core:
  • ChangeSet.Open refuses it (CHG-01), and so do session grouping and revert, which open sets through it.
  • AgentPermissions treats it as not an agent. A table lists the moves each component owns: checks moves a set from checks running to checks failed or awaiting review, and routing adds auto-publish when it lands.
  • It may read content. It may not write or delete content or definitions, open or add to a set, or call a tool (system_not_permitted).
  • Person-only actions refuse it as they refuse an agent: issuing and revoking credentials, activating and deactivating checks, and creating, disabling and enabling users. It also cannot create or revise a check. The prompt purge accepts retention as well as a person.
• Jobs: IJobHandler.RunAs, a default interface member. A handler that names an engine has its jobs run as that engine, whoever enqueued them, and the job still records who enqueued it. Job rows map the system kind both ways.
• Docs: ADR-0012 (accepted) and its row in docs/adr/README.md. CONTRIBUTING.md covers the initiator kinds and RunAs.

Why

The check engine has to move a submitted set from checks running to checks failed or awaiting review. Agents may not make those moves (MCP-06), and a job runs as whoever enqueued it, which here is the submitting agent. Recording the move as that agent would be false provenance. A service user would be a fake person in the user list and in the log. The ADR records both alternatives.

For the maintainer: AUD-01 and CHG-01 read "agent/user". The system kind covers only engine-driven moves and maintenance, never a set's initiator and never content writes. The decision record's wording can follow; this PR leaves the requirement documents as they are.

Choices worth a look:

• The job type picks the engine, not the enqueuer. RunAs sits on the handler, so no code that enqueues a job can borrow an engine's permissions, and the job row keeps who asked for the work.
• A table of moves per component. An engine moves nothing until its moves are written down, and reading is the only content access any engine has.
• Refusals are not security events. An agent's refused move is recorded (SEC-08). An engine's refused move is a fault in the product, so it returns an error and records nothing.
• A missing initiator still throws. Person-only checks refuse agents and engines by name, so code that runs with no initiator at all still fails at the audit log, as before.
• Model spend. An engine has no budget of its own. The check run will charge its model calls to the agent whose set it judges (SEC-04), and that lands with the check run.
• Touches the job queue lightly: one default member on IJobHandler, and the worker resolves the handler before it sets the run's initiator.
• Not in this PR: the check run on change sets, the scheduled retention purge, and routing's auto-publish.

Tests

Unit:

• A component's id is stable and its own. An invalid name is refused, and the kind is system.
• A change set cannot be opened, or a published one reverted, by an engine.
• AgentPermissions as checks: checks running → checks failed and → awaiting review are allowed, and nine other moves are refused. retention owns none of them.
• An engine reads content and definitions but cannot create, update or delete them, open or add to a set, or call a tool, and nothing is recorded.
• An agent still cannot move its own set to checks failed or awaiting review, and that refusal is recorded.

Integration, each on SQLite and PostgreSQL unless noted:

• An engine's event round-trips through the log, the reader and the JSON export as system, with its component and id and no credential.
• An engine cannot create, revise or activate a check, issue a credential, or create a user.
• Only retention, not checks, purges stored prompts, and each purge event names retention.
• A job an engine enqueues reads back as that engine.
• The worker runs a job as the engine its handler names and keeps the person who enqueued it (host, SQLite).
• An engine with a changed display name is stored by its component, and a component with the wrong id is refused.

The full suite ran locally against a postgres:17 container as well as SQLite, and markdownlint passes. No migration and no new package.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers