[AZ-226] Add generated tile staging

Keep generated tiles auditable and untrusted onboard while preserving
covariance, quality, and sidecar metadata for post-flight sync.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/test_tile_manager.py

@@ -1,6 +1,6 @@
 from datetime import datetime, timezone
 
-from tile_manager import LocalTileManager, TileManifestEntry
+from tile_manager import LocalTileManager, TileGenerationRequest, TileManifestEntry
 
 NOW = datetime(2026, 5, 3, tzinfo=timezone.utc)
 
@@ -76,3 +76,62 @@ def test_tile_metadata_lookup_returns_record_or_explicit_rejection() -> None:
     assert missing.found is False
     assert missing.error is not None
     assert missing.error.category == "validation"
+
+
+def _generation_request(**overrides: object) -> TileGenerationRequest:
+    payload: dict[str, object] = {
+        "mission_id": "mission-1",
+        "frame_id": "frame-1",
+        "image_ref": "replay/frame-1.jpg",
+        "timestamp_ns": 10_000,
+        "parent_covariance_m": 2.5,
+        "frame_usable": True,
+        "quality_score": 0.8,
+        "footprint": {"min_lat": 49.0, "max_lat": 49.1},
+        "source_provenance": "nav-camera-generated",
+    }
+    payload.update(overrides)
+    return TileGenerationRequest.model_validate(payload)
+
+
+def test_eligible_frame_stages_generated_cog_and_sidecar() -> None:
+    # Arrange
+    manager = LocalTileManager(trusted_signature_hashes={"sig:trusted"}, now=NOW)
+
+    # Act
+    candidate = manager.orthorectify_frame(_generation_request())
+
+    # Assert
+    assert candidate.accepted is True
+    assert candidate.cog_ref == "generated/mission-1/generated-mission-1-frame-1.cog.tif"
+    assert candidate.sidecar is not None
+    assert candidate.sidecar.trust_level == "generated"
+    assert candidate.sidecar.parent_covariance_m == 2.5
+
+
+def test_high_covariance_generated_tile_write_is_rejected() -> None:
+    # Arrange
+    manager = LocalTileManager(trusted_signature_hashes={"sig:trusted"}, now=NOW)
+
+    # Act
+    candidate = manager.orthorectify_frame(_generation_request(parent_covariance_m=7.5))
+
+    # Assert
+    assert candidate.accepted is False
+    assert candidate.rejection_reason == "covariance_too_high"
+    assert manager.package_sync("mission-1").sidecars == ()
+
+
+def test_sync_package_includes_manifest_delta_sidecar_covariance_and_trust_level() -> None:
+    # Arrange
+    manager = LocalTileManager(trusted_signature_hashes={"sig:trusted"}, now=NOW)
+    manager.orthorectify_frame(_generation_request())
+
+    # Act
+    package = manager.package_sync("mission-1")
+
+    # Assert
+    assert package.package_ref == "generated/mission-1/sync-package.json"
+    assert package.sidecars[0].parent_covariance_m == 2.5
+    assert package.manifest_delta[0]["trust_level"] == "generated"
+    assert package.manifest_delta[0]["parent_covariance_m"] == 2.5