feat: implement the FileAutomation 1.0 roadmap

[JE-Chen]

Implements the FileAutomation 1.0 roadmap (#107) on top of dev. Nothing was removed: every FA_* action, facade name and command-line flag of 0.0.x still works. docs/source/Eng/usage/migration.rst lists the few behaviours that changed.

What is in it

• Universal storage layer: File / Storage over one StorageBackend contract and one URI syntax. Twelve backends: local, in-memory, S3, Azure Blob, Google Drive, OneDrive, Dropbox, SFTP, FTP/FTPS, WebDAV, SMB, fsspec. An 88-case contract suite that every backend passes; copy_between now runs on the layer.
• Extras: the base install carries no cloud SDK and no GUI toolkit; each backend, Parquet and the GUI is an extra ([all] for everything).
• IntegrityMonitor 2.0: baselines and verification of a tree in any backend, six kinds of change, watching, opt-in remediation.
• Pipeline runtime: retry, timeout, cancellation, conditions, idempotency, checkpoint and resume, dry run, history, YAML/JSON definitions.
• Scheduler v2: cron with a time zone, manual, file, event and pipeline triggers; a record of every run.
• Events, notification router, audit schema v2: the router and the audit trail are opt-in.
• Semantic MCP tools: fourteen tools, read-only and confined to named roots by default, with a dry run.
• UI 2.0 on an application layer (automation_file.app), which the web UI renders too.
• CLI: storage, integrity, pipeline and audit subcommands.
• Docs in three languages: storage, events, integrity, audit, pipelines, scheduler, MCP, GUI, application layer, public API policy, migration, deployment, integration tests.

Problems fixed on the way

• A move between two views of one store (two roots, two prefixes) overwrote the file and then deleted it.
• WebDAVClient could be sent, credentials included, to another host by an absolute path or a redirect.
• ActionACL and the MCP --allowed-actions list did not check actions nested in the arguments of another action.
• FA_storage_verify could not fail a pipeline task; it takes strict=True now.

Decisions made here, open to change before 1.0

• OneDrive is the eleventh remote backend of the contract; Box stays action-only.
• The public API and deprecation policy (docs/source/Eng/usage/api_policy.rst).
• A MINOR or MAJOR release is made by writing X.Y.0 in stable.toml and dev.toml in the pull request to main (scripts/stable_release.py).
• tzdata is a base dependency on Windows, for time zones in the scheduler.

Checks

Locally, on Windows with Python 3.14: 5763 passed and 257 skipped with every extra, 3879 passed and 137 skipped with the base dependencies only, ruff check, ruff format --check and mypy automation_file clean.

Not verified: please read

• .github/workflows/integration.yml and tests/integration/ have never run. There is no Docker on the development machine, so this pull request is their first run. The container options, the Samba and FTP ones most of all, may need adjusting. These jobs do not gate publishing.
• No storage adapter has met a real service; all were tested against stand-ins.
• The unit tests have not run on Linux or macOS, nor on Python 3.10 to 3.13.
• UI 2.0 has only run on Qt's offscreen platform, never on a real display.
• The Sphinx build of the new pages was not run.

progress.md lists what remains open; docs/updates/2026-10.md has one entry per piece of work (U-20261008-01 to -32).

[codacy-production]

Not up to standards ⛔

🔴 Issues 3 medium · 1 minor

Alerts:
⚠ 4 issues (≤ 0 issues of at least minor severity)

Results:
4 new issues

Category	Results
UnusedCode	1 minor
ErrorProne	3 medium

View in Codacy

🟢 Metrics 9000 complexity · 81 duplication

Metric	Results
Complexity	9000
Duplication	81

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud