feat!: deliver runtime v2 and world-first Live simulation

[jBernavaPrah]

Purpose

Deliver world-first Live simulation together with the supervisor-backed runtime bootstrap and monotonic scheduling foundation.
This is one breaking implementation train, not two independently releasable changes.

• Add canonical world authoring, deterministic WorldBundle assets and provenance, shared geometry, and a complete robot simulation plan.
• Preserve each execution's monotonic timeline during attachment, pause, resume, and late join.
• Publish passive StepEvent progress through existing bounded delivery lanes with transition-correlated monotonic timestamps.
• Add transactional supervisor attachment and typed world/member lifecycle and retained evidence.
• Move Webots native generation into exact-train framework host, world-controller, and robot-controller packages.
• Support zero or multiple independently supervised robots, dynamic attachment, cooperative removal, and classified shared-world failure.
• Remove the superseded world-clock and readiness/permit paths while retaining generic runtime timeline-replacement capability.
• Publish alternate-registry packages in dependency order, verifying staged dependent archives before one atomic registry append.

Important boundaries

Live supports Webots R2025a and native REAL_TIME only.
Physics progress is not execution time and never gates service or brain scheduling.
There is no accelerated mode, profile selector, participant acknowledgement, public advance endpoint, or Lockstep implementation.
Native controller binaries are not supported on musl or Linux aarch64 in this release.
OBJ support is a conservative robot-mesh subset; authored world meshes remain self-contained GLB.

The exported contract is breaking relative to 0.67.1 and requires 0.68.0 or later.
The existing managed 0.67.2 release proposal is not the release vehicle for this implementation as currently generated.
Do not publish a bootstrap-only intermediate train.

Validation

• Workspace all-feature/all-target tests and compile-contract suite passed during implementation.
• Latest core library run: 604 tests passed, including real execution-router loss and attachment-observer regression coverage.
• Latest native package runs: 77 host library tests, 4 host binary tests, 11 robot-controller tests, and 3 world-controller tests passed; the explicitly ignored native renderer test was also run successfully on R2025a.
• Framework CI passed on ae7affeaaac984e9d6ba7c0dcd38f85e27a6a8c4, including the Linux native renderer, full workspace tests, and canonical consumer-profile matrix.
• Formatting, Clippy with warnings denied, strict rustdoc, repository policy checks, dependency checks, and compatibility reporting passed.
• Registry package ordering: 3 Python tests passed.
• Compatibility reporting identifies the breaking pre-1.0 train while preserving the frozen bootstrap boundary.

Local native evidence, not released-artifact acceptance

Using one coherent local owner checkout on macOS arm64 with R2025a and disposable robot-model copies with test brains:

• Headless zero-robot start, exact-ID world TUI reopen, compositional run, detach, discovery, and robot reattachment passed.
• Two independently supervised robots attached at different spawns, including attachment after world progress had begun.
• Pause/resume retained monotonic execution timelines; a deliberately slow brain continued with monotonic missed ticks without gating native progress.
• A distinct 100 Hz service with a 200 ms invocation reported ordinary missed ticks of 19/20 while physics advanced, then continued its monotonic invocations while world progress remained paused.
• Suspending the test execution's drive service while paused let both motor leases expire; the first resumed transition retained Expired, no selected command, and applied Stop for both motors.
• Confirmed robot stop isolated that member while the world and other robot continued.
• Hard supervisor loss isolated the responsive robot and retained SupervisorLost with complete cleanup.
• Hard synchronized robot-controller loss failed the world as ControllerLost, retained member ControllerFault, and reported unavailable isolation as incomplete cleanup instead of claiming recovery.
• Host, Webots, and world-controller loss produced typed terminal evidence and native-tree cleanup.
• Selecting the actual Webots Fast control failed a zero-robot world as UnsupportedNativeMode, named the observed Fast mode, retained terminal evidence, and removed native processes.
  Cleanup correctly recorded the missing controller stop acknowledgement after the fatal exit.
• Confirmed world stop retained complete world/member terminal evidence and removed native processes and live registration.
• Primitive and GLB visuals with implicit and explicit collision loaded natively; initial visual acceptance verified corrected lighting and camera orientation.

Host-discovered startup, paused import, sensor anchoring, orderly removal, park acknowledgement, authority loss, and terminal classification defects have regression tests and native reruns.

Still required before final acceptance

This PR remains a draft because the complete acceptance matrix is not yet proven.
The Mac became available for the native Fast-mode check, then locked again before final multi-robot visual acceptance.
An isolated stalled-output-drain test, pre-activation command rejection, cooperative controller-local fault, constrained-world pacing, and real multi-artifact compatibility cases still need explicit acceptance evidence beyond their deterministic coverage.
Suspending an execution router produced native sample-eviction evidence while physics continued, but also triggered supervisor loss and a session-close timeout, ending the world as RemovalFailed with complete native cleanup.
That experiment is not represented as isolated controller-fault recovery or lossless-lane saturation.
Artifact inspection found shared Cargo target reuse between disposable test projects, so these runs are not claimed as unmodified-brain acceptance.
Their project compilation caches are now isolated before repeating that case.
The repeated compositional run now verifies the original no-op brain: its staged SHA-256 matches the fresh isolated build, neither slow-probe marker is present, q leaves the execution and world live, native REAL_TIME advancement succeeds, and confirmed world stop plus deferred robot cleanup complete successfully.
This is still a local-owner overlay, not published-artifact acceptance.

Review and merge this owner only under the normal human review and CI gates, then publish the complete breaking train.
The dependent CLI must refresh real dependency pins and lockfiles to that published owner and repeat the released workflow before consumer merge/publication and migration-repository retirement.

[jBernavaPrah]

Follow-up corrections on this PR: transaction-owned host SIGTERM now uses orderly world cleanup and retains WorldStopped/Complete in native rollback proof; native parsing now depends directly on webots-proto-ast, removing unused JavaScript/template/resolver dependencies and their fast-float advisory chain; tracked-source policy, Rust 1.98 chunk-iteration lints, and profile-specific rustdoc have been corrected. Native package tests pass locally (76 + 4 + 11 + 3), all 17 policy rules pass, and strict rustdoc passes across the five explicit host/authoring profile combinations. Linux CI is rerunning. The existing Zenoh lz4_flex advisory is not claimed as resolved. Remaining native and published-artifact acceptance gates in the PR body still apply.

[jBernavaPrah]

Linux CI follow-up: workspace policy and Clippy now pass. The renderer diagnostic identified missing libEGL.so.1 on the runner, rather than a version mismatch. The native renderer job now installs the runtime library set from the R2025a upstream installation script: https://github.com/cyberbotics/webots/blob/R2025a/scripts/install/linux_runtime_dependencies.sh. CI is rerunning with those prerequisites; no renderer pass is claimed yet.

[jBernavaPrah]

The cancelled long-running test jobs were still compiling participant-metadata fixture binaries, not stuck in runtime simulation. The all-feature job had already passed 604 core tests and the preceding integration suites before those cold fixture builds. I cancelled the already-failed run to inspect this, so the full suites remain unverified remotely, not failed assertions or successful runs. The new rerun includes the exact Mesa environment-notice handling; all asset warnings and errors remain fatal in the renderer proof. Latest local host library checks pass 77 tests plus the explicit native renderer probe, with Clippy warnings denied.