feat(deploy,auth): warn when the V2 assertion spec is unsupported

[makemake-kbo]

Why

app.phylax.systems (Linea) runs the V1 assertion spec. Assertions written against the V2 triggers and precompiles either get rejected at release time or deploy and never fire — and pcl said nothing about it either way.

What

pcl deploy scans the assertion sources listed in credible.toml for V2-only identifiers (V2 triggers, fork helpers, fork-aware reads, protection-suite precompiles, cumulative-flow circuit breakers, PhEvm.ForkId/TriggerContext) and warns when the target is that platform or a Linea chain (59144 / 59141):

Warning: https://app.phylax.systems (Linea Mainnet, chain 59144) runs the V1 assertion spec, but these assertions use V2:
  assertions/src/VaultAssertion.a.sol — registerTxEndTrigger, staticcallAt
V2 triggers and precompiles do not run there: the release can be rejected, or the assertion can deploy and never trigger. Rewrite these assertions against the V1 spec, or deploy to a platform that runs V2.

It prints before the protocol-manager step — nothing mutated yet, so Ctrl-C is still free — and again with the result, since a long deploy scrolls the first one away. Machine output carries it in data.warnings (also on --dry-run) with code: assertion_spec.v2_unsupported plus the per-file marker list. It never blocks a deploy: the platform decides what it accepts, and a stale marker list must not be the reason a release stops.

pcl auth login warns when the login target is that platform, so the constraint is known before any assertion gets written. Human mode prints it after the login result; machine mode attaches a warnings array to the login envelope (short-circuit, --no-wait challenge, JSONL terminal event, and auth poll).

Detection

Only the project's own assertion sources are read, never the flattened output: a V2-capable credible-std declares every V2 identifier whether or not an assertion calls it, so flattened source would warn on every project. Comments are stripped, matches need an identifier boundary and a call/type shape, and unreadable files are skipped — a warning check must never fail a deploy.

Heuristic, so it can miss V2 usage that lives in a project-local helper file rather than the declared assertion file. Both directions are recoverable because the outcome is only a warning.

Not included

pcl apply also creates releases and shares the payload builder, but the ask was deploy + login; say the word and it's a three-line addition there.

Testing

• 14 new unit tests: marker detection (V1 sources stay silent, commented-out and look-alike identifiers ignored, unterminated block comments, non-ASCII sources), source scanning, warning decisions per platform/chain, envelope shapes, and the deploy/auth wiring.
• make ci equivalents green: cargo fmt --check, clippy pedantic, cargo check --features full (dev + release), full test suite, cargo doc, agent-smoke.
• Manual: pcl deploy --dry-run (human + --json) against a V2-marker fixture on production vs. a V2-capable platform vs. a V1 fixture, and pcl auth login (human + --json) against production vs. a custom platform.

🤖 Generated with Claude Code