Architecture: add transactional outbox and background ERP worker

[falltwo]

Architecture: add transactional outbox and background ERP worker

Context

This is a future hardening item that depends on A′ atomic approval and idempotent execution being merged first. It does not represent an implemented capability and does not overlap Issue #1, which tracks L1/L2/L3 interface screens.

Scope

• Persist an approved command/outbox record durably with the approval decision.
• Add a background worker with conditional claim/lease, bounded retry, observable failure state, and recovery after process restart.
• Reuse A′ operation_id, canonical action digest, resource version, and execution receipt as the business idempotency boundary.

Prerequisites

• A′ protected purchase-order approval route is merged.
• Unique operation/receipt constraints and same-database atomic PO execution are verified.
• Direct execution of the protected PO action cannot bypass a valid approval context.

Acceptance criteria

• Two workers cannot produce duplicate PO effects for one operation.
• Worker termination before/after the business commit has an explainable, recoverable state.
• Duplicate delivery returns the stored receipt without repeating the effect.
• Retry limits, terminal failure state, and operator-visible diagnostics are tested.

Non-goals / claim boundary

• This issue does not claim exactly-once delivery.
• It does not imply all ERP writes are governed or production-ready.
• It does not implement LangGraph pause/resume.