Persist retryable post-publish cleanup obligations

internal/manifest/store.go

@@ -107,6 +107,9 @@ func (s *LocalStore) Save(ctx context.Context, path string, m *Manifest) error {
 	if err := validateManifestIdentities(m.SessionID, m.Campaign, m.RunID); err != nil {
 		return fmt.Errorf("save manifest: %w", err)
 	}
+	if err := validatePostPublishCleanup(m.PostPublishCleanup); err != nil {
+		return fmt.Errorf("save manifest: %w", err)
+	}
 
 	m.UpdatedAt = time.Now().UTC()
 	if m.Stages == nil {
@@ -244,6 +247,9 @@ func validateLoadedManifest(m *Manifest) error {
 	if err := validateManifestIdentities(m.SessionID, m.Campaign, m.RunID); err != nil {
 		return err
 	}
+	if err := validatePostPublishCleanup(m.PostPublishCleanup); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -263,6 +269,27 @@ func normalizeManifest(m *Manifest) {
 	}
 }
 
+func validatePostPublishCleanup(cleanup *PostPublishCleanup) error {
+	if cleanup == nil {
+		return nil
+	}
+	if err := pathsafe.ValidateOpaqueSegment(cleanup.CommittedRunID); err != nil {
+		return fmt.Errorf("post_publish_cleanup.committed_run_id is not a portable opaque identifier: %w", err)
+	}
+	if strings.TrimSpace(cleanup.RemoteCommitKey) == "" || strings.TrimSpace(cleanup.CurrentCommitPointerKey) == "" {
+		return fmt.Errorf("post_publish_cleanup commit identity is required")
+	}
+	if len(cleanup.Targets) == 0 {
+		return fmt.Errorf("post_publish_cleanup.targets is required")
+	}
+	for index, target := range cleanup.Targets {
+		if strings.TrimSpace(target.Policy) == "" || strings.TrimSpace(target.Root) == "" || strings.TrimSpace(target.Path) == "" {
+			return fmt.Errorf("post_publish_cleanup.targets[%d] policy, root, and path are required", index)
+		}
+	}
+	return nil
+}
+
 func validateLoadedRunManifest(m *RunManifest) error {
 	if m == nil {
 		return fmt.Errorf("manifest is nil")