feat(server): coordinate replay-safe runner turns

[chrispeterson]

Stack and merge order

1. feat(server): add durable turn operation journal #4868 durable journal foundation
2. feat(runner): add replay-safe turn operations #4871 runner operation dedupe and status protocol
3. this coordinator tranche
4. feat(server): expose replay-safe turn operations #4875 public v1alpha1 route

This PR is stacked on #4868 and its runtime path depends on #4871. After #4868 merges, rebase this branch so the review diff contains only the coordinator commits.

Summary

• bind every dispatch attempt to one 32-character runner incarnation ID
• persist the exact runner dispatch envelope beside the input item so recovery never reconstructs routing, model, file, or item metadata
• preflight runner operation status before every potentially billable dispatch
• record transport loss after POST as dispatch_unknown
• reconcile any operation already visible on the same runner incarnation before considering an exact replay
• replay only when same-incarnation preflight proves the operation is absent
• terminalize changed-incarnation ambiguity as timed_out without redispatch
• treat disappearance of an acknowledged operation as a protocol failure
• add auditable attempt count and last-attempt timestamp
• use Alembic batch mode for SQLite-safe downgrade of runner-binding columns

Validation

• exact head: 43d7492fce14d01ef781fdee49b3674fe0768aaf
• 13 focused coordinator plus migration safety/round-trip tests pass at the new head
• SQLite full migration-chain round trip and unsafe-DDL guard pass
• the unrelated test_launch_cancelled_midspawn_does_not_leak_untracked_runner CI failure passed 20 consecutive isolated reruns locally
• Ruff format/check pass for the migration; prior changed-file Pyrefly remains green
• disposable combined integration with feat(runner): add replay-safe turn operations #4871 PASS: deliberately lost the first accepted POST response, then reconciled the existing runner operation without a second POST; one harness execution; terminal state succeeded
• same-incarnation absent-operation path still exact-replays once; changed incarnation remains terminal ambiguity with zero new-runner execution

Boundary

This tranche remains unwired from the public session route. #4875 supplies the authenticated principal, required idempotency key, deterministic cross-store input persistence, and typed operation status surface.

Relates to #4861.

[github-actions]

@chrispeterson Thanks for the PR! It doesn't reference an issue yet.

We require an issue for every PR, so the work can be prioritized before it's reviewed. Add one to the description:

• Closes #123 if this PR finishes the issue. That links it, gives your PR the issue's priority, and closes the issue when this merges. You can also link it from the Development section of the sidebar.
• Part of #123 if this is one step towards it. Related to, Towards, and Refs work the same way, and leave the issue open.

No issue exists for this yet? Open one first, then reference it. That's how we track what's worth doing, and it's usually quicker than it sounds. Note a reference has to point at an issue: naming another PR doesn't count.

The only exceptions are changes with no user-visible behaviour: pure Refactor / chore, Docs, or Test / CI work. If that's genuinely what this is, check that box under Type of change. Anything that fixes a bug, adds a feature, or changes the UI needs an issue, even when it also touches docs or tests.

See CONTRIBUTING.md for the full policy.

No action is taken beyond this comment.