[lweberru]

Problem and resulting behavior

The initially empty local-filesystem checkpoint gap in #140 must not be inferred for remote backends. Extend #141's deterministic local lab with the real pinned OpenTofu HTTP and S3 backend implementations against in-memory loopback protocol fixtures.

Each case starts without workload resources, captures both completed resources in an intermediate checkpoint, hard-stops only its own Apply process group and verifies a fresh Plan is blocked by the orphaned remote lock. Only after confirming that child exited does the controller remove the exact in-memory fixture lock. Fresh Plan/Apply must retain the newly created resource without replacement or ID change. No operational force-unlock path is introduced.

Validation

• Real OpenTofu 1.12.6 HTTP and S3 protocol fixtures passed, including retained checkpoints, lock-blocked Plan and successful recovery with unchanged resource identity.
• Six lab isolation/security unit tests passed; Python compile, bilingual command parity and git diff --check passed.
• Credential-free CI now runs both protocol cases with no raw-State/log artifact publication.

This is protocol-fixture evidence, not STACKIT authentication/eventual-consistency/live-lock acceptance or hosted Runner reconciliation. The S3 fixture uses dummy keys; S3 init may establish an empty State object. The initially empty local-filesystem variant remains unqualified in #140. No customer or production Plan/Apply, no cloud provisioning, no Dev deployment or Assistant changes. Refs #90, #95, #140.