fix(startup): isolate cross-version persistence

[ShiboSheng]

Problem

Fixes #840

The redesigned Team experience and official v1.3.0/v1.2.6 releases could read and write overlapping startup persistence. WorkStation layouts shared the v3 local-storage namespace even though the Team snapshot shape changed, so reopening an older release after leaving a redesigned Team tab active could feed it data it could not understand. The old and redesigned Agent Org SQLite schemas also occupied the same database without a frozen ownership contract, making downgrade cleanup vulnerable to deleting or reshaping the wrong objects.

Solution

WorkStation now writes only a v4 namespace. Startup prefers committed v4 state, otherwise performs a one-time sanitized copy from v3, then falls back to v2. The importer keeps ordinary tabs, removes only incompatible Agent Org snapshots, and never changes or deletes v3 bytes, so official older releases retain their own readable layout.

Agent Org startup now freezes both sides of the database boundary: the exact 11 private tables created by official v1.3.0/v1.2.6 and the exact final manifest of 33 tables, 69 indexes, and one trigger. Initialization accepts either an empty redesigned namespace or that complete manifest, removes only the known official legacy objects in the same transaction, and fails closed before cleanup when it sees a partial or unknown redesigned schema. An exact official-v1.3 fixture and rollback/concurrency tests cover that contract. The obsolete intermediate backfill path was removed because unpublished schemas are no longer silently upgraded.

Redesigned Team definitions remain in their separate file. Recreated legacy definition files are retired without changing the redesigned file or unrelated settings.

Potential risks

• This intentionally changes persistence behavior: after v4 has been created, later WorkStation layout changes made by an older release remain in v3 and are not merged back into v4. This prevents an older release from overwriting redesigned state, but means layout changes are version-local.
• Startup now rejects partial or unknown redesigned Agent Org schemas instead of guessing how to repair them. That is safer for data, but a developer or unpublished intermediate build may need to copy aside its isolated test database and recreate it before starting this version.
• The exact official legacy Agent Org tables are deleted on each redesigned startup. Official older releases can recreate that legacy namespace after downgrade, while redesigned runtime tables and shared session/settings data remain untouched. Rolling back this commit restores the previous heuristic behavior; recovery for an unexpected database is to preserve the database file and start with an isolated home rather than deleting unknown objects.
• The complete signed-old-release matrix ran before PR feat(agent-org): ship bounded public Team timeline #1153 was rebased. After integrating the new PR feat(agent-org): ship bounded public Team timeline #1153 head, all deterministic checks and BuildFast packaging were rerun, but the entire Computer Use downgrade/re-upgrade UI matrix was not repeated on that rebuilt binary.
• No dependency, lockfile, public API, IPC, or wire-format change is included. Visual screenshots are not useful because this PR intentionally changes startup and persistence behavior without changing the rendered UI.

Verification

• pnpm install --frozen-lockfile — synchronized dependencies for the latest PR feat(agent-org): ship bounded public Team timeline #1153 base; the lockfile was unchanged.
• pnpm exec prettier --check src/store/workstation/tabRegistry/atoms.test.ts src/store/workstation/tabs/__tests__/storage.test.ts src/store/workstation/tabs/__tests__/workspaceState.test.ts src/store/workstation/tabs/atoms.ts src/store/workstation/tabs/index.ts src/store/workstation/tabs/storage.ts src/store/workstation/tabs/types.ts — passed.
• rustfmt --edition 2021 --check <changed Rust files> — passed for every Rust file changed by this PR.
• pnpm typecheck — passed.
• pnpm run lint — passed with zero warnings.
• pnpm run check:circular — passed across 6,402 modules.
• pnpm exec vitest run --config config/vitest.config.ts src/store/workstation/tabs/__tests__/storage.test.ts src/store/workstation/tabs/__tests__/workspaceState.test.ts src/store/workstation/tabRegistry/atoms.test.ts — 32/32 tests passed.
• cargo test --manifest-path src-tauri/Cargo.toml -p agent_core core::coordination::schema::tests — 12/12 tests passed.
• cargo test --manifest-path src-tauri/Cargo.toml -p agent_core downgrade_recreated_legacy_file_is_deleted_without_changing_new_bytes — passed.
• cargo test --manifest-path src-tauri/Cargo.toml -p agent_core core::session::persistence::crud::ops_tests — 5/5 tests passed.
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings — passed.
• ORGII_AGENT_ORG_REDESIGN=1 pnpm run tauri:build:fast — passed on PR feat(agent-org): ship bounded public Team timeline #1153 head af65cf920; binary SHA-256 8df6d507c333b505fe9eca28392713ed2aa71c703e78877c1413eda1c0756bf8.
• Packaged matrix A, official v1.3.0 → redesigned final: ordinary Provider session remained usable; a real Team delegated implementation and verification, created the exact 22-byte proof file, produced Delivered reports, and survived restart.
• Packaged matrix B, redesigned final → official v1.3.0 twice → redesigned final: both old starts succeeded, an existing ordinary Provider session sent successfully, redesigned database/Team/settings fingerprints survived, exact legacy objects were retired on re-upgrade, and a new Team follow-up completed with Delivered.
• Packaged matrix C, redesigned final left on a Team → signed official v1.2.6 twice → redesigned final: both old starts reached the main UI without white screen or crash, and the final build reopened the complete Team history.
• Direct SQLite readback after the matrix: PRAGMA quick_check returned ok; redesigned Agent Org objects were exactly 33 tables, 69 indexes, and one trigger; all 11 known legacy tables were absent.
• Full cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check was also run and reports pre-existing formatting differences in unrelated PR feat(agent-org): ship bounded public Team timeline #1153 base files. Those files are outside this diff and were not reformatted here.

Audit

The architecture review covered ownership, type/schema contracts, transformation boundaries, write paths, initialization parity, downgrade/restart lifecycle, persistence authority, failure atomicity, legacy cleanup, and deterministic/real-app evidence. Frontend UI and performance audits were not applicable because this PR changes no React component and adds no polling, timer, cache, subscription, worker, or background lifecycle.