carlos / platform Public

Temporary static sites: self-expiring tmp- apps, trashed at expiry, purged 3 days later

Adds a "temporary" static app for LLM scratchpads and one-shot customer
pages: `carlos deploy --temporary [--ttl 3d] ./dir` creates an app named
tmp-<label> that moves to the Trash when its TTL runs out (default 7d,
1h..30d) and is purged 3 days after that instead of 30. `carlos apps
ttl|keep|list` move the expiry, make an app permanent, and show every
app with its expiry or purge date. Spec:
docs/superpowers/specs/2026-09-25-temporary-static-sites-design.md
(rev 9; rulings 1-8 are Paul's).

How it holds together:
- All lifecycle state lives in four new console `apps` columns
  (expires_at, restoring, purge_after, purge_for). Nothing new is written
  to the bucket and box code is unchanged, so bucket write access cannot
  make an app temporary and an old box keeps its 30-day behaviour.
- Every transition (expire, trash, restore, keep, ttl, purge) runs under a
  per-app mutex (account lock first where both are taken), settles the row
  against the trash marker, and re-checks before acting.
- A 5-minute console pass expires due apps through the ordinary trash path
  and early-purges through release.PurgeAppIfTrashedAt, which acts only if
  the marker's clock matches the row's purge_for. The empty-bucket
  tripwire (now ignoring trash markers) holds every absence-based action.
- The tmp- namespace is reserved at every door that can create a name
  (claims, rename, grants, backfill, carlos add), so an expiry can only
  drop routes a temporary app created. Temporary apps stay static and
  platform-hosted: domains (incl. the instance catch-all), binaries,
  stores, private storage, email, relay, sidecars, fleet placement,
  production and control plane are refused until `carlos apps keep`.
- Creation is off until CARLOS_TEMPORARY_APPS=1, and temporary creates
  have their own 50/day budget. Cap: 20 live temporary apps per account.
- Every displayed purge date (Trash page, trash API, CLI, delete
  confirmation) comes from one effectivePurgeAt.

Reviewed: spec through 9 Astra rounds, plan through 7, each of 12 tasks
by a separate reviewer (4 needed one fix round), a Fable whole-branch
review, and an Opus review of the origin/main merge resolution. All user-
facing copy (105 strings) approved by Paul in copy review. Gate: build,
vet, gofmt, go test ./..., darwin and windows builds.

Rollout (needs approval, not done here): roll every box first, scan box
registries and the console's apps/owners tables for tmp- names, then set
CARLOS_TEMPORARY_APPS=1 on the console.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>