fix(agent-org): stabilize real-provider lifecycle convergence

[ShiboSheng]

Problem

Fixes #1051

PR8F established formal Plans, receipts, completion certificates, and final summaries, but the real packaged-App journey still exposed gaps between message delivery, Task execution ownership, cancellation and reassignment, work-episode closure, and historical presentation.

Those gaps could reject a second Group mission, mix new work into an unresolved episode, leave terminal Tasks stuck in Needs attention, repeat Planner work, lose Member round history, or require manual intervention after execution had already become safe and terminal.

Solution

This PR is stacked on the PR8F head in #1052 and stabilizes the complete lifecycle as one review unit:

• Route Root Group follow-ups through the durable Coordinator turn queue and keep follow-up Turns FIFO instead of steering them into fixed active Turns.
• Give each mission an explicit work episode so cancellation, replacement, completion certificates, and later missions remain separate.
• Tie Task completion and handoff release to exact Task, Turn, and process-tree finality; keep genuinely unknown execution recoverable through the typed decision flow.
• Make Cancel, Keep stopped, Continue replacement, Abandon episode, and Reassign persist their accepted decision before slow shutdown work and remain retryable.
• Enforce formal Plan completion, duplicate Task rejection, user-cancelled scope closure, and correct dispatch after exact TaskAssigned materialization.
• Restore Member round and Plan history across episodes, keep Team Overview controls readable and collapsible, and order Plan and terminal Task history by canonical timestamps.
• Add an additive history paging index plus a strict compatibility upgrade for the exact previous runtime schema; unknown schemas continue to fail closed.

The Agent Org redesign rollout gate remains closed. This PR stays Draft until stacked review and final acceptance are complete.

Potential risks

• This is a broad stacked lifecycle change across Rust persistence, scheduling, process ownership, Tauri projections, and React UI. Concurrency and restart behavior are the highest-risk areas.
• The history cursor is versioned to v2 and now uses the authoritative sort timestamp. Any in-memory v1 cursor is rejected and the UI must refetch; no persisted user data is rewritten.
• The new SQLite history index is additive. Startup upgrades only the exact recognized previous manifest and verifies the full canonical manifest afterward; unexpected partial schemas still fail closed. Rollback is to close the rollout gate and revert this stabilization stack. The added index may remain harmlessly if code is rolled back.
• Real Provider output is nondeterministic. Backend invariants reject duplicate or illegal lifecycle mutations, but wording and timing can still vary between runs.
• No signed Release, notarization, installer, or updater validation was run because this behavior does not depend on release-only packaging.
• The repository-wide circular check still reports two pre-existing unresolved raw imports, and all-target Clippy still reaches an unrelated existing bool assertion. Changed-owner TypeScript, ESLint, Cargo check, and agent_core library Clippy are clean.
• Packaged-App screenshots were captured locally during acceptance but are not attached to this Draft because no GitHub-hosted upload URL was produced in this environment.

Verification

• cargo test -p agent_core --lib --quiet -- --test-threads=1 — 3391 passed, 2 ignored.
• cargo clippy -p agent_core --lib -- -D warnings — passed.
• cargo check -p agent_core and cargo check -p org2 — passed.
• pnpm run typecheck — passed.
• Focused frontend Agent Org suites — latest Team Overview suite 25 passed; reassignment and Select suites 27 passed.
• Focused Plan, Task pagination, scale, and schema suites — 29, 27, and 11 passed.
• ESLint and Prettier on changed frontend files — passed; commit hook reported total eslint 5 and circular 0 for staged files.
• Ten-thousand-Task history pagination contract — passed with the bounded page and byte limit using the history index.
• Gate-enabled BuildFast packaged App — built successfully with the real Rust backend, SQLite, RPC, and filesystem.
• Real codexmaggie GPT 5.4 Mini packaged-App task — Planner Plan approval, Implementer file creation, Tester exact-content verification, and Coordinator delivery completed 3 of 3 with 0 active and 0 pending.
• Real UI behavior — pending Plan auto-expanded, Plan history and Current work collapsed and expanded with counts preserved, Current work moved 2 to 1 to 0, and History displayed Tester, Implementer, Planner newest first.
• User manual packaged-App verification covered follow-up missions, cancellation choices, reassignment, retry recovery, Member round history, and continued work after a cancelled episode.

Rollout and rollback

Keep this PR and #1052 Draft with the redesign gate closed. If review or additional acceptance finds a regression, close the gate and revert the stabilization commits from this branch. The schema change is additive and preserves existing rows, so rollback does not require destructive data cleanup.

[ShiboSheng]

Database compatibility follow-up

This PR currently contains two temporary compatibility paths for the immediately preceding schema manifest:

1. If agent_org_runtime_inbox_task_bindings is missing, the initializer creates the table and backfills the existing Inbox-to-Task bindings.
2. If idx_agent_org_runtime_tasks_history_page is missing, the initializer creates the history pagination index without discarding existing data.

These paths exist only to preserve continuity for Stabilization development and packaged-app test sessions. They do not define the database upgrade or downgrade compatibility contract for this PR, and they do not change the current reset-only policy in the Design Doc.

Follow-up plan: after the current 10-PR stack is complete, a dedicated database compatibility PR will define schema version detection, upgrades, downgrades, rollback, and data-preservation behavior as one coherent design. That PR must remove or replace the two temporary paths above and their temporary migration tests so they do not become an accidental long-term compatibility commitment. Until that follow-up lands, unknown or partially corrupted schemas must continue to fail closed.