✨ Add shared source-only SPANK configuration injection

🤖 AI text below 🤖

Lead: @flowerthrower. Cross-repository coordination: @burgholzer.

Elevator pitch

Replace provider-specific environment-injection implementations with one small optional component that administrators can build without compiling Core or provider SDKs.

Current state

Braket has an injection-only SPANK module; IQM combines injection, provider validation, and license checks. Core already owns static-license device selection.

Work and decisions

• Reuse proven injection behavior and define one provider-neutral configuration-reference contract with explicit applicability and precedence.
• Keep provider names, credential parsing, AWS/IQM clients, and QDMI sessions out of the module.
• Use job environment values, never accidentally inherit slurmstepd service credentials. Do not log secrets or accept a shell command as a credential shortcut.
• Build/install the GPL-3.0-or-later component independently with Slurm headers and a compiler; do not require LLVM or provider SDK configuration.
• Audit licenses and exclude GPL SPANK source/binary from MIT PyPI wheels and sdists. Preserve third-party notices.
• Extend this same component for optional launch checks only when their separate tests pass.

Dependencies and release boundary

Parent: ✨ Centralize static-license QDMI deployment and optional SPANK injection. Consumer migrations: ♻️ Replace IQM Slurm integration with the shared Core setup, ♻️ Replace Amazon Braket Slurm integration with the shared Core setup. Optional validation: ✨ Add optional generic SPANK launch-time device validation.

Acceptance and validation

• Isolated Slurm tests cover default/inherited/explicit precedence, malformed input, unrelated licenses, multiple providers, and safe failure without node drain.
• SPANK-only configure/build/install works without Core, LLVM, or provider SDK builds.
• Artifact tests inspect wheels/sdists and installed component licenses.
• No provider runtime or secret material is embedded in the module.
• Target Core 4.1/MQSF with the shared setup and provider migrations.

Non-goals

Availability scheduling; dynamic credential resolution; arbitrary provider policy; a second provider-specific plugin framework.

Shared fixture integration

Build and exercise this source-only component in Core's common Dockerized Slurm fixture. Provider tests supply configuration and catalogues; they do not fork the scheduler setup. Keep the SPANK-only build free of LLVM and provider SDK dependencies, and inspect wheel/sdist contents to verify the MIT/GPL separation.