[FLO-3.4] Integrate an immutable Aniflow release

[szmyty]

Note

2026-09-27 release boundary: This first adapter consumes the immutable Aniflow release from aniflow#10. The later qualified music-video profile is released under aniflow#40 and integrated under flow#75; it does not block #53/#54.

Parent: #3
Suite roadmap: #11
Depends on: #49 and egohygiene/aniflow#10
Coordinates with: #31 and #33

Outcome

Add the production Aniflow adapter using an immutable, independently installable release. Flow can discover, plan, execute, validate, resume, and explain the supported media-analysis/transformation capability set without bypassing its authority model.

Acceptance criteria

• Pin the exact Aniflow release, artifact digests, CLI/API contract, schemas, tools, and declared effects.
• Implement availability/version probing and exact capability negotiation.
• Map structured Flow plans and durable checkpoints to Aniflow invocations without shell interpolation.
• Preserve stream-aware temporal metadata, provenance, validation evidence, cancellation, and resume semantics.
• Refuse incompatible or unverified provider versions with actionable diagnostics.
• Add success, unsupported-capability, provider-missing, timeout, cancellation, malformed-output, and stale-checkpoint tests.
• Prove the adapter from a clean install using a small redistribution-safe fixture.
• Generate operator documentation and compatibility evidence from tested truth.

Cross-cutting requirements

• Pin an immutable provider release by exact version and digest.
• Translate provider-native failures into Flow's typed diagnostics without discarding original evidence.
• Preserve source artifacts; no provider may receive mutation authority implicitly.
• Record provider identity, contract/schema versions, capability discovery, arguments, environment assumptions, and output digests in durable run evidence.
• Exercise clean-room installation and an end-to-end fixture through the public Flow API.
• Keep unsupported capabilities explicit and fail closed.

Non-goals

• Importing provider source into Flow.
• Shell-interpolated command execution.
• Claiming capabilities the pinned provider release does not prove.