v1.40.0: claimable work-queue cards (W2a)

Added

• Work-queue cards (roadmap Track W, milestone W2a). Four new tables (cards, card_deps, card_runs, card_comments, schema v42 to v43) give hippo a claimable unit of work: N candidates can attempt to claim one row and exactly one wins, the same single-writer guarantee PRAGMA busy_timeout already gives every other write path. src/card.ts defines the status machine (backlog -> ready -> running -> {blocked, review} -> {done, shelved}) as CARD_TRANSITIONS, and transitionCard in src/store.ts is the one function that ever writes cards.status, checking the static map before issuing any SQL so an illegal transition fails fast regardless of the row's current state. createCard validates its title and an optional positive-integer budget, then checks that every dependsOn id exists for the tenant and reads each parent's status inside the same write transaction as the insert, so an invalid input or an unknown id commits nothing and a parent that completes concurrently cannot leave the child stuck in backlog; a repeated dependsOn id is recorded once. claimCard, blockCard and reviewCard validate their own required input (runtime, reason) and, together with completeCard, throw unknown card id: <id> for a card id that does not exist or belongs to another tenant rather than returning null; a card that exists but is in the wrong state still returns null. Every catch-block ROLLBACK across the five write functions is guarded so it cannot mask the real error when COMMIT has already rolled back. completeCard closes the live run with the given outcome: success moves the card to done and promotes, in the same transaction, any child whose parents are now all done, not best-effort; failure or partial moves the card to shelved and promotes nothing. blockCard closes the run it interrupts with outcome = 'blocked', so a later completeCard on a reclaimed card only closes the live run.
• hippo card create|show|list|claim|block|review|complete|comment, mirroring hippo handoff's subcommand and tenant-resolution shape. card show <id> renders the card, its dependency graph, its runs, its comments, and loadLatestHandoffForCard(hippoRoot, tenantId, cardId), the new store function that lets a card-keyed handoff (session_handoffs.card_id, added in W1) be looked up from the card side. Each subcommand rejects a flag it does not read, including a mistyped --depend-on or a --flag=value that never reaches the parser as a value, with a hint toward the correct usage.
• createCard, loadCard, listCards, loadCardDeps, loadCardRuns, loadCardComments, claimCard, blockCard, reviewCard, completeCard, addCardComment, loadLatestHandoffForCard, and the card.ts types are exported from src/index.ts for programmatic use. addCardComment throws unknown card id: <id> for a card outside the caller's tenant or that does not exist, and rejects an empty body.