Deliver current published runtime and replay fixes in the shipped examples #338

The shipped examples still select Server 3.3.2, PHP SDK 3.11.0, Python SDK 2.14.1, Rust SDK 4.12.0, Workflow 2.22.0, Waterline 2.13.2 and CLI 2.3.3. New users therefore miss published fixes, including settling unawaited activities when a workflow closes and replaying that cleanup correctly.

Owner: sample-app. General assigned the published-tuple update and qualification. No open Sample App issue or PR already covers this work; #299 and #334 are complete. Shared conformance coverage (.github#122) and setup-php migration (.github#297) remain separate work.

Update the artifact tuple and its Composer/Cargo consumers together, using published packages and a digest-pinned Server image. Coordinate the corrected Server release, Python SDK 2.17.1, Rust SDK 4.15.0 and published CLI 2.8.0 so full qualification runs once on a coherent tuple. Server 3.9.0 promotion is held for server#934. Python 2.17.1 must include sdk-python#306 so replay handles the new run-close cancellations. Keep the README's existing-database upgrade and rollback instructions accurate.

Acceptance:

• Both Laravel application locks, the PHP playground lock and both Rust consumers match the selected tuple.
• Existing application checks, PHP/Python/Rust playground journeys and published SDK experiments pass with the selected packages. Run the existing full polyglot diagnostic for all meaningful workflow/activity language directions.
• Publish the developer image through its protected workflow, accept its existing security policy and both native architecture startup checks, and verify the published image embeds the new tuple.

Prepared in draft #339, commit 44c10f3: both Laravel locks and the PHP playground use PHP SDK 3.17.0, Workflow 2.28.0 and Waterline 2.18.0. All three Composer files validate, both Laravel artifact graphs and the playground SDK match the tuple, dependency audits found no known advisories, and public-boundary/credential/whitespace checks pass. The preparatory commit skips CI; final qualification remains required. Temporary containers are removed and the branch is pushed.

Python 2.17.1 (with sdk-python#306) and CLI 2.8.0 are now published, independently verified in their registries, and selected in draft #339. Python wheel SHA256 is 90040cb28906985b227988815b1b53aa3079378673e35c689392ac71edaf7b35; its owner reports 1,089 clean installed-package controls. CLI installed acceptance is recorded on cli#145. These version selections do not replace the final coherent-tuple qualification.

Rust 4.15.0 is now published and both consumer manifests/locks select it. The only lock changes are SDK version/checksum; both match registry SHA256 2ddc164f7e98bd172b1ec3fe9d1960411924112c0fe3c5a3c553475a9ca14cb4. Published lifecycle/deadline and API-doc identity acceptance pass. The SDK owner is separately correcting large-fanout externalization in sdk-rust#254; Server#1136 remains its separate over-limit transport dependency. Those cases are not a #228 pass and stay distinct from the normal Sample App journeys.

The Rust owner explicitly recommends keeping published 4.15.0 for this ordinary journey scope; its larger fan-out correction remains separate. The admitted PHP CI migration from #341 is merged into this preparation branch.

Next action: Server owns the combined 3.9.1 release covering the legacy-key correction and completion correction, followed by published-image qualification and the exact version, index/platform digests and source identity. The earlier proposed 3.9.2 split is superseded. No final tuple qualification has launched. The Server owner has been asked to flag any required worker-version changes; Sample App will reconcile the SDK owners’ final published-version recommendations at the freeze. Both current open items, this issue and draft #339, wait on that external receipt. Sample App then pins the qualified Server, checks database-upgrade and SDK worker-rollout notes, runs existing CI/full diagnostic, and publishes the protected developer image. Keep this issue open through image delivery. No production deployment or credential change is part of this work.