workflow: deliver a hook resume carried on the queue

[fantix]

This is similar to the resilient start, and mirrors vercel/workflow#1834 with a few following fixes.

In short, a vqs message to resume a hook can now also carry the actual payload, in addition to the hook_received workflow server event. And these 2 things may arrive without a particular order for performance, so the SDK must be able to handle all cases properly.

This would unblock the hook-based e2e test fixtures. This PR does not introduce any public API.

---

The bug

Resuming a hook takes two writes: the hook_received event, and the queue message
that wakes the run. resumeHook() can do both at once and put the payload on
the message — so a delivery can arrive before the event exists.

We never read that payload. The replay found nothing new, suspended, and answered
200:

run_created, run_started, hook_created, wait_created     ← log at replay time
hook_received                                            ← producer's write, landed after

Nothing was left to wake the run: exactly one message is published per resume, and
this delivery consumed it. The resume was lost, not delayed.

In the TypeScript e2e suite hookWithSleepWorkflow stalled on its first payload
every time; hookWithSleepFinalStepWorkflow escaped only because its driver sends
a second payload, whose delivery replays the whole log and repairs the miss.
Setting WORKFLOW_DISABLE_LAZY_HOOK_RESUME=1 on the driver made both pass, which
is what pinned the cause.

The fix

Layer	Change
world.py	hookInput on the invoke payload, token on hook_received, resumeId on the stored event, HOOK_RESUME_INPUT_VERSION
runtime.py	write the event before replay when the log lacks it; advertise the version from start() and the health-check answer
worlds/vercel.py	forward the resume identity on the request; the backend enforces it
worlds/local.py	no server to defer to, so a (runId, resumeId) claim file, byte-shaped like world-local's
ulid.py	decode_time(), so the event is dated when the resume happened rather than when we got to it

Two writers of one resume must collapse into one event, or the workflow body
gets the payload twice — worse than the stall. That is what the identity is for.

One divergence from world-local — worth a look

A claim whose event has not landed yet: upstream takes over the position,
reasoning that only a crashed writer leaves one behind. That holds while both
writers share the process its per-hook lock serializes. Across processes it does
not — the other writer numbers events by position, so finding ours where it meant
to publish it bumps to the next free slot instead of failing. Two events, in
three of eight suite runs.

We raise instead, costing one redelivery. What that gives up is a writer that
really did crash between its two writes; that resume now exhausts a retry budget
rather than being quietly taken over. Same reasoning tightens _is_resume_event:
upstream also accepts an event with no resume id at the claimed position, which
across processes is an unrelated payload for the same hook, and adopting it would
drop this one silently.

Verification

• 29 passed | 108 skipped against the TypeScript e2e driver, up from 27, with
  both hookWithSleep* fixtures off unsupported and zero duplicated resumes in
  the logs of six runs.
• New integration test drives a real LocalWorld with a producer that publishes
  before writing. Reverting the handler hunk fails all three of its tests with the
  original signature (log is ['run_created', 'run_started', 'hook_created']).
• Unit coverage split by layer, matching the resilient-start tests: models,
  handler, local world.

Not in scope

• hookInput.deploymentId is parsed and unused; upstream re-routes a misrouted
  delivery with it, which this SDK does for no message type.
• resume_hook() still writes hook_received without token. Harmless while it
  is the only writer of its event, but it is the same lossy-parsing family as the
  other hook gaps.
• Found on the way: a log containing a created-event the body never issues makes
  resume() spin forever instead of failing. Pre-existing, filed separately.