feat(runs)!: add governed Builder successor retries

[alvaroloes]

What changes

• Add immutable runs.retry_of_run_id lineage and a governed
  POST /v1/runs/:runId/retry operation that creates at most one direct
  successor for a failed, fully tracked, plan-linked Builder attempt.
• Preserve the exact Gate 1 proposal, plan hash, repository/base/issue
  identity, agent, mode, engine and trigger while keeping every terminal parent
  and its events, transcript, usage, receipt and sandbox evidence immutable.
• Revalidate the complete ancestor chain, current plan/fingerprint freshness,
  credentials, request/write leases, sandbox teardown and exhaustive remote
  GitHub output before inserting or dispatching a successor.
• Fail closed for tracking-version-0 or otherwise ambiguous historical runs;
  the operator receives an actionable fresh-Gate-1 requirement instead of
  fabricated legacy evidence.
• Block generic resume and conversation continuation for Builder runs across
  REST, MCP/conversation and worker paths. Non-Builder resume behavior remains
  unchanged.
• Add a default-off promotion flag for rolling deployment, generated OpenAPI
  and SDK contracts, migration 0045, audit events and adversarial concurrency,
  lineage, replay and preflight coverage.

This PR is stacked on codex/governed-retry-security-primitives because a
successor is safe only after the predecessor's request fencing, durable
repository-write leases, run-unique branches and terminal revocation controls
are present.

Why

A Builder can finish its local work yet fail before a durable GitHub delivery.
Generic resume mutates or revives the same attempt and cannot preserve the
required-plan approval source safely. Re-running an executed proposal also
cannot create an auditable second attempt under the existing root uniqueness
rules.

The governed successor keeps the failed attempt immutable, preserves the exact
human-approved identity and admits a new run only when Facility can prove that
all old effects are quiescent and no ambiguous delivery exists. Historical
runs that predate durable write tracking intentionally require a fresh
Architect proposal and explicit human Gate 1 decision.

Verification

• CI=true pnpm verify passes completely: all real failures are fixed, but
  two pre-existing runner 100 ms timeout flakes failed under global load
• Builder plan integration: 37/37 passed
• Producer-inventory focal regression: 1/1 passed
• Policy/config/producer inventory: 47/47 passed
• Focal API: 97/97 passed
• Focal DB with fresh migration: 18/18 passed
• SDK: 23/23 passed
• Global acceptance DB/API/Gateway: 21/21, 677/677, 57/57 passed
• Global runner workspace: 179/181; both pre-existing timeout flakes
  passed isolated and bounded Git delivery passed 3/3
• Hosted GitHub CI: verify, minimum-node, self-host-build,
  sandbox-e2e, title and commit-subject checks passed
• Build, lint, API/DB/SDK typechecks and remaining packages passed
• Biome, git diff --check and migration compatibility passed
• Independent reviews found P0=0, P1=0, P2=0

The clean global gate initially found one genuine issue: production run
producer #20 was absent from the governed producer inventory. The final commit
adds builder-plan-producer-inventory.test.ts with marker and AST assertions,
and all related regressions pass. pnpm verify is not described as completely
green because the two pre-existing 100 ms runner flakes still failed under the
global load, despite passing in isolation.

Non-blocking P3 review notes:

• generated OpenAPI currently marks the request body required even though the
  server accepts {};
• migration DDL is not concurrent and should use the normal controlled
  deployment window;
• ancestry validation is O(depth) with a hard cap of 100, and live external
  GitHub verification retains an unavoidable post-validation TOCTOU boundary.

Breaking change

Builder runs can no longer use generic resume or conversation continuation.
Operators must use the governed immutable-successor operation, or obtain a
fresh Architect proposal and explicit Gate 1 decision when durable tracking
evidence is unavailable. Generic non-Builder resume behavior is unchanged.

BREAKING CHANGE: generic resume and conversation continuation now fail closed
for Builder runs; use the governed immutable-successor retry operation.