test: add immutable Linux late-slope diagnostic tooling

scripts/validation/opcua-lifecycle-memory/late-slope/README.md

@@ -0,0 +1,71 @@
+# Linux late-slope diagnostic
+
+The [protocol](../LATE_SLOPE.md) fixes 7,200 seconds of canonical cycling from
+startup completion, with the existing active restart every fourth cycle. The
+cycle-three baseline and resource caps remain in force. A latched rejection
+keeps the original failing test and container exit. The result records
+`acceptance=false` even when the diagnostic completes its duration and shutdown.
+
+The analyzer requires an ordered active, recovered-stall, resource-observation,
+quiescent and complete-cycle ledger. It checks the 25-second restart helper
+bound, 30-second complete cycle bound and 60-second shutdown bound. It
+recomputes the first cold rejection and verifies its assertion against the
+actual TRX. It checks each fixed time window and the entire 1,800–7,200 second
+range before reporting RSS and retained-managed slopes in bytes per hour.
+The report includes sample counts, quiescent peaks, final values and coverage.
+It identifies whether the earlier saturation workload had completed by 1,800
+seconds, which bounds any interpretation relative to the previously observed
+restart step. The raw JSONL keeps every sample and the first assertion stack.
+
+Certificate allocation stack tracking remains enabled and contributes to the
+measured process. The slope report is descriptive and carries no resource
+pass threshold. Quiescent peaks refer to the sampled points.
+
+## Offline controls and artifact preparation
+
+The synthetic controls exercise the parser, receipts and bundle manifest with
+temporary files. Run them with Python 3.11 or later.
+
+```bash
+python3 scripts/validation/opcua-lifecycle-memory/late-slope/test_offline.py
+```
+
+Prepare from the reviewed clean commit containing the canonical test and tools.
+The image argument is the immutable ID of a locally cached Linux ARM64 SDK
+image. The explicitly selected Docker context must use a local Unix socket.
+The preparation command publishes the self-contained .NET 10.0.14 app and
+records the exact SDK 2.0.1 and HistorianGateway 1.0.0 graph, source hashes, file
+hashes and managed module MVIDs. It uses the repository's read-only PE metadata
+inspector. Preparation completes before any descriptor or lifecycle test runs.
+
+```bash
+python3 scripts/validation/opcua-lifecycle-memory/late-slope/prepare.py \
+  --source-revision "$reviewedRevision" --docker-context "$localContext" \
+  --image "$cachedImageId" --output "$bundle"
+python3 "$bundle/tools/launch.py" --bundle "$bundle" \
+  --receipt-sha256 "$reviewedBundleReceiptHash" --verify-only
+```
+
+## Reviewed run and analysis
+
+Root owns launch after review of the exact bundle receipt and controls. The
+bundled launcher uses the pinned Unix endpoint, immutable image, network-none
+container, read-only root filesystem and read-only application and tools mounts.
+A fresh private task directory holds results and fixture files. The two
+descriptor controls must execute successfully before the canonical test starts. The launcher verifies
+the actual test process's apphost, mapped CLR and CLR hash. Its outer deadline
+is 7,440 seconds, with cleanup limited to the uniquely labeled container.
+
+```bash
+python3 "$bundle/tools/launch.py" --bundle "$bundle" \
+  --receipt-sha256 "$reviewedBundleReceiptHash" --output "$run"
+python3 "$bundle/tools/analyze.py" --run "$run" \
+  --bundle-receipt "$bundle/receipt.json" --bundle-receipt-sha256 "$reviewedBundleReceiptHash"
+```
+
+A completed diagnostic with a cold-cap rejection has a nonzero launcher exit.
+Its receipt records diagnostic completion separately from the actual test and
+container status. The offline analyzer verifies the reviewed bundle receipt,
+raw evidence hashes, test identities and outcomes, fixed duration and verified
+shutdown before emitting a report. It can run from copies of the small bundle
+receipt and run evidence on a machine without Docker.