fix(blueprints): fail closed on marker ownership for apply and withdraw (#1694)

* fix(blueprints): fail closed on marker ownership for apply and withdraw

Require a matching .blueprint.json under the stack lock, persist required_blueprint_id on deletion intents, remove the legacy remote apply fallback, and protect the marker in the file explorer.

* fix(blueprints): add CodeQL path barriers on ownership probes

Use the canonical resolve-and-startsWith sanitizer inline at the marker and stack-directory fs sinks so js/path-injection clears.

* fix(blueprints): block delete on failed withdraw and defer marker write

Refuse Blueprint DELETE when pre-delete withdraw does not complete, and write .blueprint.json only after a successful deploy so failed applies cannot orphan stacks or claim an unapplied revision.

* test(blueprints): align lock-order assert with deferred marker write

Update the per-stack lock ordering expectations to compose, cleanup, deploy, then marker after the partial-apply fix.

* fix(deps): bump postcss past GHSA-r28c-9q8g-f849 for npm audit

Raise the Vitest/Vite transitive postcss to 8.5.23 so Backend CI audit --audit-level=high passes.

backend/src/helpers/blueprintMarker.ts

@@ -0,0 +1,28 @@
+/**
+ * Dependency-neutral blueprint marker parse helpers.
+ * Used by BlueprintService and DeployedStackDeletionService without a service import cycle.
+ */
+
+export const BLUEPRINT_MARKER_FILENAME = '.blueprint.json';
+
+export interface BlueprintMarker {
+  blueprintId: number;
+  revision: number;
+  lastApplied: number;
+}
+
+export function parseBlueprintMarker(content: string): BlueprintMarker | null {
+  try {
+    const parsed: unknown = JSON.parse(content);
+    if (!parsed || typeof parsed !== 'object') return null;
+    const obj = parsed as Record<string, unknown>;
+    if (typeof obj.blueprintId !== 'number' || typeof obj.revision !== 'number') return null;
+    return {
+      blueprintId: obj.blueprintId,
+      revision: obj.revision,
+      lastApplied: typeof obj.lastApplied === 'number' ? obj.lastApplied : 0,
+    };
+  } catch {
+    return null;
+  }
+}