Add Phase 6 request-scoped orchestration runtime

[paullizer]

Summary

• add a request-scoped, in-process OrchestrationRun execution graph shared by direct and coordinated turns, with DAG validation, terminal node lifecycle, required/optional failure policy, finalizer gating, bounded read-only retries, opt-in safe parallelism, and bounded replanning
• reconcile existing authorized conversation, document, image, workspace, web, source-review, agent, and action outputs into the runtime without moving Flask-scoped authorization work into worker threads
• integrate standard streaming and document actions with node progress, selected-agent required-attempt enforcement, evidence-discovery gating, cancellation, terminal cleanup, provenance, and compact persisted runtime metadata
• update version 0.250.063, orchestration documentation, release notes, and stream lifecycle regression contracts

Validation

• Phase 1-6 orchestration and compatibility checks: 84/84 passed
• stream heartbeat, background execution, lifecycle, reattach, and stop-control checks: 5/5 passed
• route policy contracts: 12/12 passed
• Python compilation and VS Code diagnostics: clean
• full-file Broken Access Control and XSS scans: passed
• staged whitespace validation: clean

Phase Boundary

• runtime remains in-process and request-scoped; no durable queue or process-loss resume
• synchronous SDK cancellation remains best effort, with pending finalization blocked and late results discarded where possible
• non-grounded selected-agent and Analyze/Compare paths retain compatibility finalizers until central synthesis expands to those output profiles

Refs #1021