feat(agent-org): add authoritative team lifecycle

[ShiboSheng]

Problem

Replaces #824.

Fixes #756.

Agent Org did not have one authoritative, restart-safe lifecycle boundary for a long-lived Team. Initial materialization, quiescence, Run View reads, watchdog recovery, and frontend polling could not yet guarantee that a Team moves safely through Starting -> Running/Idle/Failed, becomes quiet in Idle or Failed, and can later be extended without introducing another state owner.

Solution

This branch starts from origin/develop at 641c43c8a37edfb89fb5b07d61bad7083c3bca18 and contains one adapted commit only.

• Add durable Starting materialization receipts and authoritative lifecycle transitions.
• Centralize quiescence so a Team enters Idle only from committed facts.
• Keep Run View pure-read.
• Use one bounded watchdog and shared frontend polling ownership, stopping polling while hidden or otherwise non-pollable.
• Keep the redesign behind one fail-closed rollout gate.

The resulting PR1 boundary does not add Pause/Resume, Archive/Delete, the Task FSM rewrite, Writer settings, UserDirectedWork, or Group-send behavior.

Potential risks

• The redesign remains disabled by default and fail-closed. Existing rollout behavior must not be inferred to expose the new lifecycle to normal users yet.
• Lifecycle recovery spans persistence, Session state, watchdog work, and frontend polling. Focused and full automated suites pass, but the stacked packaged true-machine run exposed a blocking convergence defect: after more than 20 minutes, the Run remained running although the coordinator and all four Members were idle, all materializations had succeeded, and tasks, unread inbox entries, and interventions were all zero.
• The required foreground/hidden idle performance measurement is blocked because the packaged Team never reaches the Idle precondition. This PR must remain Draft until the convergence defect is fixed and that measurement is rerun.

Architecture and performance audit

Reviewed compilation, structure, lifecycle semantics, fail-closed branches, persistence ownership, naming, wire compatibility, initialization parity, and launch/run-view resolver symmetry. The selected change keeps one bounded global watchdog, bounded recovery budgets, and shared polling ownership; it introduces no per-component polling owner or unbounded cache.

Verification

Passed on this PR tip:

• cargo check -p agent_core -p org2 -p session_persistence --all-targets
• cargo test -p agent_core agent_org -- --nocapture — 237 passed.
• pnpm run typecheck
• focused Vitest for agentOrgRunViewStore.test.ts — 12 passed.
• git diff --check origin/develop...HEAD
• Commit hooks, including scoped Rust Clippy.

The complete stacked tip was also verified after PR3 was added; those results are recorded in #836.

The stacked packaged app was rebuilt successfully with the redesign compiled and enabled:

• ORGII_AGENT_ORG_REDESIGN=1 WEBDRIVER=1 pnpm run tauri:build:fast -- /private/tmp/ORG2-stack-834-836.app — passed in 364.3 seconds.
• Physical macOS UI launch, Team selection, workspace selection, fake-provider/model selection, and Send all worked. The coordinator and four stable flat Member sessions materialized, and the fake-provider reply rendered.
• The rollout gate also failed closed when omitted, as intended.
• Lifecycle convergence failed on the same packaged run as described under Potential risks; idle visible/hidden performance sampling was therefore not claimed.

cargo fmt --all -- --check reports formatting differences already present on origin/develop in untouched files. No changed file in this PR contributes to that output.

Commit provenance

• Selected source commit 7beec790733035741ed7c5591d31e2a8264bea3b -> adapted commit 239702009cab1d60baa288a2120cfee0df1b3891, authored by Shibo Sheng.