[P1] Enforce codebase ownership for explicit workflow resume by run ID

[brAperia2025]

Context: CodeRabbit feedback on upstream PR coleam00#1875 surfaced a likely-valid safety issue in our fork.

Problem:

• packages/core/src/orchestrator/orchestrator-agent.ts validates workflow name/status/path for workflowOptions.resumeRunId.
• It does not verify the run belongs to the current codebase/project.

Impact:

• P1. A run ID from another codebase could be resumed in the wrong project/worktree context.

Acceptance criteria:

• In the explicit resume-by-ID path, verify run.codebase_id matches the current codebase.id before setting explicitResumableRun.
• Return a clear platform message when ownership differs.
• Add tests for matching and mismatched codebase IDs.

Reference:

• CodeRabbit comment: Merge AISRV Archon state model into dev coleam00/Archon#1875 (comment)