feat(project): make Work Item execution durable across providers and routines

[Neonforge98]

Problem

Project execution could start work without a durable execution episode tying Work Items, Sessions, Routines, provider turns, and terminal accounting together. Interruptions could leave runs or routine fires active indefinitely, while a successfully finished Run could leave its Work Item in an active state with no clear review queue.

The surrounding product boundaries also had several gaps: Project-mode sessions without a linked Project treated the missing Project as missing input even though the data model supports org-level Work Items; create/update receipts were not reliable navigation surfaces; local branch builds could be confused with or replaced by a production update; and large local histories made metadata-only session changes capable of triggering unnecessary replay materialization.

Solution

• adds durable WorkItemRun records, typed failure/retry policy, execution snapshots, path locks, and a transactional dispatch outbox
• routes Project turns, Routines, Discussion wakes, Stage barriers, provider webhooks, and follow-ups through the unified dispatcher
• keeps Run finality separate from human Work Item acceptance: a successful Run moves native active work to In Review, never directly to Done
• preserves explicit terminal/custom statuses, ignores failed or cancelled Runs, rejects stale execution callbacks, and makes terminal replay idempotent
• supports native and CLI provider harnesses with shared Project context, PM CLI access, skills/rules/hooks, and durable token accounting
• treats Project as an optional Work Item relation: Project mode can create, list, read, and update org-level standalone Work Items without asking the user to choose or create a Project
• carries linked Work Item context into every Project-mode provider session and keeps receipt fallback behavior consistent across providers
• turns successful Work Item create/update receipts into clickable cards that open the canonical My Station detail tab with the correct organization scope
• remounts Work Item detail at its identity boundary and preserves loaded content during background refreshes, preventing stale or blank detail panels when switching same-type tabs
• adds discussion threads, readiness, subscriptions, typed properties, Work Item usage, session navigation, and Routine/Stage persistence
• recovers provider turns interrupted by app restart through bounded Session-resume retries
• makes in-process delivery event-driven and uses the PM change watermark for external CLI or desktop commits
• tracks transcript content revision independently from session metadata, so rename, pin, and access changes do not reload or rewrite full histories
• bounds and coalesces cloud preparation and provider repository identity resolution
• preserves the mode boundary: Project includes build plus PM workflows, while Build remains build-only
• embeds branch/SHA provenance in local builds; on macOS a local build installs a verified production release separately at /Applications/ORG2.app instead of replacing itself, while production releases retain in-place updating
• keeps existing GitHub issue SSR structure tests synchronous across the React 19 lazy-Markdown boundary

Potential risks

• schema and dispatcher changes touch Work Item execution, session launch/resume, routine scheduling, and successful-Run lifecycle projection
• retry ancestry and startup reconciliation rely on persisted Run/Session identity; tests cover idempotency, attempt limits, terminal convergence, stale locks, and human reopen behavior
• normal dispatch remains notifier and watermark driven; the final missed-signal recovery scan is intentionally coarse to avoid idle database polling
• one-time routines disable after firing by design
• the separate production installer is macOS-specific and validates the archive, bundle identity, release version, and signing identity before atomically replacing /Applications/ORG2.app

Validation

• all 1,024 TypeScript test files and 8,275 tests passed
• all 613 Project Management tests passed, including 23 focused WorkItemRun tests
• Project Management, Session Persistence, dispatcher, Routine, bridge, provider parser, updater, and historical reconciliation Rust tests passed
• TypeScript, ESLint, rustfmt, staged checks, and Clippy passed for all touched crates
• native, Claude CLI, and Codex CLI Project/Build boundary tests passed
• dual macOS app build completed successfully
• Computer Use created and executed WI-0094 through a real native SDE Session; the Run finished succeeded, the Work Item displayed In Review, and usage showed 59.1K tokens (58,115 input / 989 output)
• a second independent app identity showed the same WI-0094, In Review state, completed Session, and token summary through the UI
• Computer Use created WI-0097 from a Project-mode SDE Session with no Project, without a scope question; the item persisted with project_id = NULL and reached In Review
• from a deliberately wrong historical tab, clicking Open work item: WI-0097 switched My Station to the correctly scoped detail showing its title, body, No linked Project, In Review, completed run, and 10.4K token usage
• the final local bundle contains branch codex/durable-workitem-runs and SHA 62734f98f439570690255e96fc1773a3690d3fef
• metadata change plus reload tested against a 5.2 GB session database with more than 223,000 events; no multi-GB replay peak
• more than four hours of single-instance soak plus 90-second single and dual-instance CPU/RSS sampling; memory remained bounded and the prior recurring 30-second database spike was removed

[Harry19081]

CI failed - please check.