feat: network capability deactivate command

Paris Stentoumisrequested to merge
refactor/network-capability-deactivate into refactor/tf-sdk-wiring

Summary

  • Implement command.srm.network.capability.deactivate end-to-end: replace the NATS no-op with a real command coordinator and use case.
  • Resolve the target realization by service_instance_id or external_ref (exactly one live, active match for the caller's app_provider_id); create a DEACTIVATE_CAPABILITY order with target_service_instance_id set to the session holder.
  • Call adapter.deactivate_capability, treat already-gone backends as success (ResourceNotFound / runtime-state probe), terminate the capability instance, and terminate the holder when it was the last live child.
  • Mirror activate/terminate patterns for accept → status → complete / fail_after_accept, including terminate-style replay of COMPLETED/FAILED orders.

Test plan

  • Unit: accept happy paths (service_instance_id / external_ref), zero/many matches, unsupported & sync-query kinds, non-active / missing refs, replay
  • Unit: complete success, already-gone paths, non-terminated adapter result, last-live-child holder teardown, fail_after_accept
  • Application: coordinator invalid payload → failed_before_start; accept → status + completed; replay; fail path
  • API: dependencies wiring + NATS subject bound to deactivate coordinator (not no-op)
  • pytest for the above + ruff/mypy on touched modules

Merge request reports