[Phase 7] schemas/conventions/MegaTask/API fixes (15 findings, scan-fix program)

[rennf93]

Phase 7 of the 9-phase codebase-scan fix program (serial, stacked). Do not merge independently — the CEO merges all 9 PRs bottom-up to master after the program completes. This PR stacks on Phase 6 (#320, fix/scan-panel-frontend).

Scope

15 audit findings fixed across the API schemas, the architectural-conventions standard, the MegaTask confirm-batch path, and the roadmap cycle-completion audit:

ID	Fix
H21	DelegateRequest.estimated_complexity retyped as Complexity enum (whitelist validator); redundant int-rejector deleted
H22	SoftBlockRequest.resolver_type retyped as BlockerResolverType (422 on typo); try/except → AGENT silent downgrade + resolver_type_raw deleted
H23	TaskResponse.documents field + convert_documents helper (defensive .get)
L27	Deleted SubstituteRequest.suggested_role/suggested_team (zero consumers)
L14	Envelope.not_found gains a default remediate (mirrors not_authorized)
L28	Deleted unused ListResponse[T] generic (per-domain *ListResponse preserved)
H19	_delegate_static_guards admits a cell-projects coordination root (narrow clause, not the broad is_branchless_coordination predicate)
M13	MegaTask confirm_live_batch Redis SETNX idempotency guard + result sidecar (keyed by session_id); fail-closed on redis-unreachable
M14	Root-subtask draft strips assigned_to so an injected board-role uuid can't deadlock the umbrella
H20	thin_routes receiver-gates add/add_all/merge (only trips on a session-handle receiver); seen_tags.add/cache.add no longer false-positive
M16	_NOQA_CODES capture tightened to [A-Z0-9, ]+; sanctioned # noqa: TC001 because … no longer false-blocked
M45	ensure_read_clone(force=True) from resolve_workspace — force-fetches the read clone on every conventions read, closing the 30s stale-map window after a default-branch merge
L25	ConventionsService._resolve returns raw (root, sha); the three callers mutate ORM on the event loop (was mutating off the event loop on a worker thread — unsafe under SQLAlchemy 2 async). Faithful port preserves the if sha is not None guard + the head = sha or _head_sha(project) cache-key/health fallback
M15	open_conventions_pr force-pushes the disposable scaffold branch (--force-with-lease); a second conventions edit no longer silently opens nothing
L24	RoadmapService._maybe_complete_cycle emits a task.completed audit row via the canonical chokepoint (was a direct task.status = set — invisible to Delivery observability)

Plus a CHANGELOG commit and a trailing lint gate-hygiene commit. 17 commits, 35 files, +1220/−130.

Audit-drift resolutions (deliberate deviations from the plan's literal text)

• M45 reframed from "force-refetch after open_conventions_pr" to force-fetch ON READ — open_conventions_pr opens a scaffold-branch PR, it does not advance the default-branch HEAD, so tying the refetch to it would not close the stale window. The sha-keyed cache handles the rest (no content_hash migration).
• L25 is the faithful port, not the plan's literal "set both fields = sha" one-liner (which would wipe head_commit for non-git paths and break the cache key / health head_sha).
• H19 uses a narrow cell_projects clause, not the broad is_branchless_coordination predicate.
• L24 is the roadmap site only; the sibling x_engine/video_post completion sites are out of scope.

Gate

Green: ruff format + ruff check clean across the repo; mypy roboco/ clean (358 files); pytest 12014 passed / 418 skipped / 95% coverage.

Reviews

• 15 sonnet per-task reviews — all Approved, zero Critical/Important.
• Opus whole-branch review — SHIP, no fix wave. The M45 ⚠️ (whether every get_map caller routes through resolve_workspace) was resolved: every read-path caller (project.py:471, _base.py:339, task.py:1162) routes through it; the workspace=None callers are write/create-path only. The two conventions.py fixes (M45 + L25) compose cleanly; M13+M14 in prompter.py don't conflict.

Deferred e2e note (M13)

The plan's "real Redis e2e" for M13 is infeasible — tests/e2e_smoke/harness.py provisions no Redis. The SETNX guard + sidecar are unit-tested with a _FakeRedis/_BoomRedis patch over redis.from_url (mirroring test_heartbeat_mutex.py). Adding Redis to the e2e harness is a separate infra lift, out of scope for this fix program.

Merge

CEO merges bottom-up after all 9 phases. This PR retargets to master once Phase 6 (#320) merges.

[github-actions]

Thanks for opening your first pull request on RoboCo!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• make quality — ruff format check, ruff check, mypy, pytest (≥80% coverage), and the rest of the gate
• Panel changes pass pnpm lint and pnpm exec tsc --noEmit (run from panel/)
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## [Unreleased] in CHANGELOG.md
• Signed the CLA (the bot will prompt you on this PR)
• Signed your commits — master requires verified signatures (SSH signing setup)
• Updated any affected docs under docs/

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.