[A3S Cloud/H0] Certify JetStream delivery and credential rotation

[ZhiXiao-Lin]

Cloud gate

H0 — production delivery evidence for a highly available control plane.

Planning reference: https://github.com/A3S-Lab/Cloud/blob/e2a05b7f1f63486b2fda866b22aa84eea89aadb4/docs/development-plan.md

Problem

Cloud relies on Event for durable relay and cross-process delivery. H0 requires proof that the JetStream provider preserves the documented contract through reconnects, redelivery, credential rotation, consumer drift, and poison messages.

Scope

• Add real JetStream integration tests for reconnect, redelivery, deduplication, acknowledgement loss, and dead-letter handling.
• Support credential rotation and reconnect without losing or duplicating logical delivery state.
• Detect and report durable-consumer configuration drift before silently changing delivery semantics.
• Preserve correlation, causation, tenant, and schema-version metadata end to end.
• Define schema-evolution behavior for compatible, unknown, and rejected event versions.
• Export delivery lag, redelivery, dead-letter, reconnect, and consumer-health metrics.

Acceptance criteria

• Tests run against a real NATS JetStream server and cover server and client restart.
• Duplicate transport delivery remains visible to consumers while the logical deduplication contract is deterministic.
• Rotating credentials recovers within a bounded interval without message loss.
• Poison messages reach a diagnosable dead-letter path without blocking unrelated subjects.
• Metrics and errors contain no credential or event-payload secrets.

Non-goals

• Cloud business-event schemas.
• Exactly-once side effects across arbitrary consumers.
• A Cloud-specific workflow engine.

[ZhiXiao-Lin]

The first always-on JetStream evidence slice is ready for independent review in #2.

Evidence:

• PR head: e05debf6e6c1884c80111995b691b8ad9755f0e7
• CI run: https://github.com/A3S-Lab/Event/actions/runs/29686483828
• Rust quality: success (fmt, strict Clippy, all-feature and minimal-feature matrices, rustdoc with warnings denied, package verification)
• NATS JetStream 2.11.8: success against the official image pinned at sha256:71092f77d707a4a81b12aca5096d6b2d2e07ad16aa57c84066940a17af74f61a
• real JetStream suite: 11/11 passed, including deduplication, durable subscriptions, strict manual delivery assertions, newest-first bounded history, concurrent publishing, and redelivery after an acknowledgement is intentionally lost
• A3S_EVENT_REQUIRE_NATS=1 now fails closed, so CI cannot report success by silently returning when NATS is unavailable

The real gate exposed and the PR fixes two previously hidden provider defects: wildcard characters produced invalid durable-consumer names, and DeliverPolicy::Last caused history queries to return at most one event regardless of limit.

This does not close #1. Server/client restart, bounded reconnect behavior, credential rotation, explicit consumer-drift detection, poison-message/DLQ certification, end-to-end metadata/schema behavior, and the full delivery/reconnect/consumer-health metrics acceptance criteria remain open for subsequent slices.