feat: add Slurm image lifecycle jobs

[nabinchha]

📋 Summary

Add the structured CPU Slurm lifecycle needed to import digest-qualified OCI images and inspect existing SQSH artifacts. The lifecycle stages checksum-bound package resources beneath the selected workspace and submits a thin, isolated batch job through the shared Slurm launcher.

🔗 Related Issue

Part of #867

🔄 Changes

• Add a versioned image lifecycle plan that binds the authored request, selected profile, attempt-local paths, source OCI digest, and package-owned runtime resources.
• Render CPU-only OCI import and existing-SQSH inspection jobs with safe Enroot URI normalization, exact checksum verification, restrictive workspace staging, and isolated sbatch submission.
• Ship a standard-library-only inspector that records factual client Python/package/installer metadata or serving vLLM version/executable metadata inside the target image.
• Extract the existing batch directive and shell quoting logic into shared launcher primitives without changing generation script output.
• Add behavioral coverage for both lifecycle modes, contract mutations, source credential rejection, symlink/path safety, exact-byte tamper rejection, and client/serving inspection records.

🔍 Attention Areas

⚠️ Reviewers: Please pay special attention to the following:

• images/lifecycle.py — CPU Slurm and Enroot command semantics, checksum boundaries, and attempt-local staging.
• images/records.py — persisted lifecycle invariants and separation of source OCI identity from produced SQSH identity.
• Atomic publication, per-target lifecycle locking, collision handling, and failure cleanup remain intentionally scoped to 867#3.

🧪 Testing

• make check-slurm passes
• make test-slurm passes — 600 tests
• make test-slurm-wheel-install passes
• Unit tests added for OCI import and existing-SQSH inspection
• E2E tests: N/A for this slice; sealed real-Slurm acceptance remains in Harden the Slurm runtime and validate sealed release artifacts #870

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs: N/A — this internal lifecycle slice does not change a documented public surface

[greptile-apps]

Greptile Summary

Adds a checksum-bound Slurm lifecycle for importing digest-qualified OCI images and inspecting existing SQSH artifacts.

• Introduces validated lifecycle plans, attempt-local resource staging, and isolated batch submission.
• Adds CPU-only Enroot import and inspection scripts with digest verification and restrictive filesystem permissions.
• Extracts shared Slurm directive and shell-quoting helpers without changing generation-script behavior.
• Adds behavioral tests for lifecycle preparation, rendering, execution, tamper detection, path safety, and inspection records.

Confidence Score: 5/5

The PR appears safe to merge with no concrete correctness or security failures identified.

The lifecycle plan, staged resources, generated script, Slurm submission boundary, and inspection contracts remain internally consistent across the changed implementation and tests.

Important Files Changed

Filename	Overview
packages/data-designer-slurm/src/data_designer/slurm/images/lifecycle.py	Implements lifecycle preparation, checksum verification, deterministic batch rendering, Enroot execution, and isolated Slurm submission; no actionable defect was established.
packages/data-designer-slurm/src/data_designer/slurm/images/records.py	Adds immutable lifecycle plan records and validates workspace-derived paths, operation/source consistency, and package-owned runtime artifacts.
packages/data-designer-slurm/src/data_designer/slurm/images/resources/inspect_image.py	Adds a standard-library-only image inspector whose client and serving requirements align with the existing inspection contract.
packages/data-designer-slurm/src/data_designer/slurm/launcher/batch.py	Extracts validated batch-directive rendering and shell quoting into shared launcher primitives.
packages/data-designer-slurm/src/data_designer/slurm/launcher/renderer.py	Adopts the shared rendering primitives while preserving the existing generation-script structure.
packages/data-designer-slurm/tests/images/test_lifecycle.py	Covers lifecycle modes, URI normalization, contract mutations, staging permissions, tamper rejection, and inspection-record compatibility.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant Lifecycle
    participant Workspace
    participant Slurm
    participant Enroot
    participant Inspector
    Caller->>Lifecycle: prepare(request, profile, lifecycle_id)
    Lifecycle->>Workspace: Stage inspector, Enroot rc, plan, and batch script
    Caller->>Lifecycle: submit(prepared job)
    Lifecycle->>Workspace: Verify plan and script digests
    Lifecycle->>Slurm: "sbatch --export=NIL"
    Slurm->>Enroot: Import OCI when required
    Slurm->>Enroot: Create and start container
    Enroot->>Inspector: Inspect client or serving image
    Inspector->>Workspace: Atomically write inspection.json

Loading

_{Reviews (1): Last reviewed commit: "feat: add Slurm image lifecycle jobs" | Re-trigger Greptile}