Harden cancellation, recovery, and concurrency

[chriswu727]

What changed

• Propagate durable task cancellation into in-flight model and tool coroutines, descendant runs, host process groups, Docker cleanup, Kubernetes Job deletion, gateway transports, and authority revocation.
• Add a loop.operation/v1 write-ahead journal so recovery refuses an operation whose side-effect outcome is unknown instead of blindly replaying it.
• Require stable operation ids for email and calendar writes and carry them into SMTP Message-ID and CalDAV UID without claiming upstream exactly-once semantics.
• Replace stale-directory project locks with OS-backed cross-process file locks that can be safely acquired and released from worker threads.
• Add Alembic revision 0010_operation_journal and update architecture, security, loop, README, and Gate 2 strategy documentation.
• Extend Kubernetes acceptance to kill and recover Postgres and run another verified task.

Why

Cancellation previously only became visible between agent steps, a cancelled host command could leave descendants running, and a worker crash between a tool side effect and Step persistence could repeat a mutation. Stale lock eviction could also remove a legitimate long-running project lock. These gaps made duplicate delivery and recovery unsafe despite the durable queue.

The new boundary is intentionally at-most-once: Loop records an operation before execution, clears it with the hash-chained Step, and fails closed when the outcome is unknowable.

Validation

• 459 API tests passed.
• API ruff, ruff format, and strict mypy passed.
• An empty SQLite database migrated through 0010_operation_journal.
• 20-way duplicate claim, workspace isolation, source-lock contention, and resource-gate tests passed.
• Cancellation fault injection passed for host process trees, Docker, Kubernetes, gateway HTTP, MCP startup, and delegated task trees.
• Queue acknowledgement crash and terminal Receipt write failure tests passed.
• Web 18/18 tests and desktop 14/14 tests passed.
• Root lint, typecheck, test, and production build passed.
• Targeted Prettier checks and git diff --check passed.

The real Redis restart and k3d Postgres interruption harnesses run in required GitHub CI; the local Docker daemon was unavailable.