fix: consolidate runtime repairs and durable task reconnect

[jmagar]

Problem and resolution

Task polling lost its upstream route after a gateway restart, and several runtime and operator UI repairs remained outside the canonical branch. This change makes persisted task routes reconnect to the configured upstream with ownership, OAuth epoch, capability, cancellation, and deadline checks, and consolidates the retained repairs.

Changes

• Bound Code Mode artifact publication, retention, and retrieval caches; separate execution and runner responsibilities.
• Preserve OAuth isolation and cancellation during task reconnect and configuration changes, without replaying task creation.
• Repair console conversation updates, discovery collections, gateway status, and notification refresh behavior.
• Add credential-free ChatGPT setup previews, sanitized Tailscale errors, documentation, CI policy checks, and worktree identity tooling.

Verification

• Final gateway, Code Mode, and auth: 2,767 tests passed; 13 skipped.
• Final selected Labby library and integration suites: 3,294 passed; 18 skipped using bounded concurrency and an owned short temporary path.
• Final frontend suite: 1,403 unit tests and 18 installation checks passed; lint passed. Initial frontend build passed.
• Final Clippy with warnings denied across all four changed Rust packages/all targets passed. Formatting and module reachability passed. Final full documentation checks passed. Identity tests: 13 with disposable HOME; all 14 production snippet fixtures passed. Final built-in snippet integration gate: 7 tests passed, including all 11 shipped offline workflows. Tailcat strict lint and isolated Windows owning-module compilation with warnings denied passed.
• Review regressions: 51 auth/task tests, 37 final schema-3 task/adversarial tests, and four completion regressions passed. The final broad runtime rerun passed after local disk space recovered. Real get/update/cancel blocked-store cancellation and deadline cases, plus pending v2 migration replay, passed.

Review and limitations

Lavra review fixes include durable revocation intents with configuration phase ownership, cancellation/deadline fences, stale conversation and bulk-import protection, effective installer gates, warning-clean Windows Tailcat scoping, complete builtin snippet catalog coverage, and self-contained identity tooling with exact worktree association and honest partial/error coverage. All 30 installed Lavra review roles are accounted for, and all confirmed findings are fixed. Hosted verification of the final follow-up commit remains pending. SDK task subscriptions and terminal-route garbage collection remain separate outstanding work. Task-route schema 3 migrates versions 1/2; older binaries reject it. Pending revocation failure stays fail closed and may require successful reconciliation or restart recovery. Restoring obsolete routing data after revocation is unsafe. Native Windows, production Linux deployment, and live appliance qualification are not claimed.