powerqueue v0.12.0

The scheduler is now a functional core with an imperative shell, the
groundwork for stronger testing of the queue's decisions, and the
default-branch policy reading introduced in 0.11.0 no longer locks the
CLI out or stalls the daemon when the branch cannot be read.

Changed

• The scheduler is a functional core with an imperative shell: every task
  and session state change is a pure function returning Effects
  (scheduler::{transitions,commands,launch,review}), and the daemon only
  loads rows, persists what changed and carries the effects out. The
  budget core (Ledger::build, resolve_clock, the observation history
  rules) takes plain rows; store access lives in budget::io. budget plan runs the daemon's LaunchPlanner; priority simulate shares its
  preferred-model helper. Events logged from a cancel or retry now carry
  the session they ended (a refused retry names none). task pause|resume| cancel|retry applied offline (no daemon) use the daemon's own
  transitions: an offline retry of a finished task starts over (attempts,
  error and summary reset) and an offline resume clears a PRIORITY.md
  skip, as they do with the daemon running.

Fixed

• task retry of a task with a live session no longer keeps the ended
  session in the daemon's nudge list.
• A task parked because its PR URL is unusable has its retry time
  cleared like every other parked task.
• A status-line usage payload without readings no longer reads the
  observation history before being dropped.
• A .powerqueue.toml that cannot be read from the default branch no longer
  locks every command out: status, doctor, config show, stop, pause
  and the rest run with config.toml alone and say so (status --json and
  config show --json carry the error); only run refuses to start.
• doctor, tune and config validate read .powerqueue.toml from the
  commit the daemon loaded it from, even when that file sets
  default_branch itself.
• Whether .powerqueue.toml exists on a branch is now an exit-status probe
  (git cat-file -e), and git runs with LC_ALL=C: a localized git no
  longer turns a missing file into a hard error.
• The daemon retries a reload that failed (a half-written config.toml, a
  git lock) every check instead of waiting for the next change, logs it once,
  and doctor reports a daemon still running the configuration from before
  such a change ("config reload").
• A git failure while checking .powerqueue.toml for changes keeps the last
  known fingerprint and is logged once (daemon.overrides_check_failed)
  instead of causing a spurious reload (which also reset the GitHub
  rate-limit backoff) once git recovered.
• A reload asked for by config set moves the change baseline, so the next
  check no longer reloads the same change a second time.
• The periodic git fetch runs on a blocking thread; an unreachable remote
  no longer stalls hook processing and stop / pause for the duration of
  the network timeout. A fetch before a task start counts as the periodic one.
• repo.fetch_interval_secs is capped at a week by config validate; an
  absurd value no longer panics the daemon's first tick.
• priority simulate --json prints one JSON document when the rules file is
  missing (rules_missing: true) instead of two; the priority commands'
  missing-file hint names the branch when the rules are committed.
• A relative priority_file in .powerqueue.toml is normalised (./,
  doubled slashes) and one that leaves the repository (../x) is rejected
  when the file is applied, instead of making the rules permanently
  unreadable.
• config show marks values from .powerqueue.toml by editing the parsed
  TOML (toml_edit) rather than scanning lines, and a repository
  instructions value is attributed to claude.append_system_prompt, the
  key it changes.