Make refining a real task state backed by a session row

[MJohnson459]

Problem

A refine in flight was invisible to the store. The proposal sat in the triage
queue mid-rewrite, advertising a body about to be replaced, and any window could
hand down a verdict racing the agent's own voro set --body-file. There was no
completion or failure signal either: spawn_expansion recorded nothing, so a
refine agent that died left the proposal looking exactly as it had before anyone
asked for a rewrite.

Change

refining is a first-class task state (migration 0016 widens the tasks CHECK).
The task leaves the queue in every window at once, because the scheduler's
next-action query does not list the new state, and a triage verdict from
refining is an illegal transition the store refuses — the mid-refine race
closes by construction rather than by guard code. legal_actions(Refining)
offers only the cancel.

Both refine flavours open a sessions row. The headless one records it in the
same transaction as proposed → refining (Store::record_refine_launch, the
shape record_dispatch established) and kills its agent if that write fails;
the interactive one is recorded by the foreground round-trip, which now spawns
rather than running to completion so the child's pid is known. PlanTarget:: Create sessions still record nothing, having no task to transition.

Four triggers conclude a round, all landing on the one refining → proposed
transition, which also closes the round's session with the matching outcome:

• the rewritten body arriving — a voro set carrying --body/--body-file on
  a refining task, which is the verb the refine prompts already end with
  (session completed);
• a dead agent, caught by reconcile-on-read (failed);
• quitting an interactive session without writing (aborted, no marker — a quit
  is a no-op, not a failure);
• the new C key on a running-strip row, which kills the agent's process group
  as well as moving the state — the escape hatch for a hung round reconcile
  cannot catch.

Reconcile pid-checks a refining session whatever verbs its agent defines: a
refine round is a direct sh -c child whose pid Voro holds, so the supervisor-
owned claude --bg caveat that gates the probe for dispatches does not apply.

Cockpit: running_rows widens to state IN ('running','refining') and the
strip renders a round as ⟳ refining with its elapsed time; the detail card and
C work on it, while attach/dispatch/open no-op with an explanation as
elsewhere. state_counts gains refining, rendered in the header so a proposal
that has left the triage count stays felt. ↻ refined is now derived from the
round that just concluded rather than from any refined event ever, so it
promises the body is the rewritten one; a failed round gets its own red
⚠ refine failed, same lifecycle, because an absence is not something the
operator should have to notice. Both markers ride the queue digest as counts.

DESIGN.md is updated in the same change — §3 (next-action), §5 (schema), §6 (the
state, its transitions, the removal of the "refine is an event, not a state"
paragraph, the four triggers and the two markers), §8 (refine sessions, the
softened "an open session implies executing", the reconcile bullet), §9 (the
strip and the c/C key pair) — along with the triage/set help text.

Verification

cargo test --workspace (597 tests) and cargo clippy --workspace --all-targets -- -D warnings pass. New coverage: the transitions in the §6 matrix, the marker
derivations and session-outcome mapping, running_rows including refining,
queue exclusion and the state counts, migration 0016 against a pre-0016
database, both reconcile halves, and — in the TUI — queue exclusion, strip
rendering, the cancel key, the transition menu offering only the cancel, and the
dispatch keys explaining themselves on a refining row.

Driven end to end against scratch databases with stub agents: a headless refine
leaves the queue and returns marked ↻ refined; a killed agent returns it as
⚠ refine failed within one read with the session failed; C on the strip
kills a hung round and returns it unmarked; an interactive round applies through
set --body-file (session completed); and quitting one without writing returns
it unmarked (session aborted). A copy of the real 334-task database migrates
from schema 15 to 16 with every row and state intact.

One cosmetic consequence worth knowing: eight proposals in the live database
carry a legacy refined event with no concluded round, so they lose their
↻ refined marker. That is the point of the new derivation — the old marker
only ever promised that a rewrite had been asked for — and the next round on
any of them re-marks it.