fix: harden orchestration performance and recovery

[numnx]

What changed

• Refactored Git and workspace execution to reuse project-scoped helpers, reduce container churn, and make worker branch creation/finalization atomic.
• Hardened Docker setup-image caching, workspace volume cleanup, branch collision detection, ambiguous push reconciliation, and restart recovery.
• Preserved durable planning and QA continuations across runtime restarts, including exact workspace/session reuse and automatic QA follow-up until a terminal guardrail is reached.
• Made CI-repair guardrails count one attempt per actual provider invocation, not per scheduler publication pass.
• Added resettable, deduplicated CI-repair handoffs for task and sprint-level final-merge repairs.
• Migrated legacy guardrail marker storage to support taskless sprint-level subjects without foreign-key failures.
• Recovered setup-image build-lock acquisition when restart cleanup removes its parent directory.
• Stabilized native release-candidate installation and startup across Windows and macOS, including
  deterministic smoke-only exit after packaged readiness.
• Kept compact two-slot hosts fully concurrent and made fake-provider DAG capacity deterministic
  across CI runners without weakening production resource admission.
• Reduced QA prompt growth while preserving the current task's full details and relevant completed-task titles.
• Improved realtime snapshot stability, bounded event replay, dashboard workflow projections, and sprint/task status badges.
• Added easy/standard live-page presentation rules and corrected planning, pull-request, QA, CI, and human-intervention workflow evidence.
• Expanded deterministic orchestration stress coverage and synchronized canonical/public documentation.

Why

The runtime could accumulate excessive retained orchestration state, repeatedly start short-lived Git/helper containers, lose durable workspace ownership across restarts, and encounter branch/worktree races during QA or merge finalization. CI repair could also charge one real provider attempt multiple times while replaying host publication, immediately re-lock a task after an operator reset, or stall a sprint-level repair on a legacy database constraint. Together these gaps caused slow invocation startup, unnecessary CPU/memory pressure, JavaScript heap exhaustion under very large DAGs, and occasional failed or stalled continuations.

User and developer impact

• Faster, lower-churn provider and Git startup paths.
• Durable planning, task, QA, CI-repair, and merge-conflict recovery after restarts.
• Correct bounded CI-repair retries with one human handoff and a usable operator reset.
• Safer worker branch creation and push reconciliation without overwriting unrelated refs.
• Bounded realtime/dashboard payload work and clearer workflow status presentation.
• Stronger local stress evidence for wide DAGs, conflicts, QA repair, cleanup, and multi-project orchestration.

Validation

• pnpm run ci passed before the final focused CI-repair follow-up:
  • 6,137 backend tests passed, 12 skipped; coverage thresholds passed.
  • 2,537 dashboard tests passed, 1 skipped.
  • audit, typecheck/lint, documentation guardrails, and production build passed.
• Final focused follow-up:
  • pnpm run lint passed.
  • pnpm run test:backend passed: 467 files, 6,146 tests passed, 12 skipped.
  • pnpm run build passed.
  • pnpm run check:docs-web and git diff --check passed.
  • Docker CI/QA/restart DAG passed twice after the fixes, including two forced restarts, QA requested-changes follow-up, one sprint-level CI repair, sprint QA, terminal completion, and zero residual workspace volumes.
  • The exact setup-image lock race is covered by forcing the first lock creation to fail with restart-time ENOENT; the parent is recreated and the same acquisition succeeds.
• pnpm run test:e2e: 74/74 Playwright tests passed.
• Native release-candidate follow-up:
  • 31 focused Electron, workflow-health, and adaptive-admission tests passed.
  • pnpm run lint, pnpm run build, pnpm run check:docs-web, and git diff --check passed.
  • Prior macOS RC logs confirmed that the packaged app reached backend and renderer readiness but
    its smoke-only quit request was deferred; the probe now exits directly with code zero while
    production shutdown continues to drain the embedded runtime.
• Rapid orchestration suite: 3/3 passes, 291 tests per pass.
• Electron/HOST QA DAG: 3/3 passes.
• Merge-conflict DAG: 3/3 passes.
• Completion-time merge-conflict DAG: 3/3 passes.
• Full standard DAG scenario set: 1/1 pass.
• 129-task large DAG stress: 3/3 passes, 129/129 tasks merged each time with no stalls or dependency violations and complete workspace cleanup.

The 400-task extreme DAG rerun was stopped at the user's request to commit and publish.

Risk and rollback

This is a broad orchestration/runtime change touching durable continuation state, Git/worktree handling, Docker lifecycle, guardrail persistence, realtime projections, dashboard status rendering, and native release-candidate validation. Roll back by reverting commits d02a674d2a65d1c09ca382e52dfe15a88b9ac3ea, 1b29091e7f8884667b8496b221407cca5835473a, and a2fa33b524d591c390f0d716e2181de7fe47270c.

Before rollback, pause or settle active hosted QA/planning continuations. Older runtimes may not understand newly persisted continuation state such as awaiting_provider, so reverting while active work is in flight can require manual reconciliation.