feat(server): make rollback recovery durable

[rynfar]

Problem

Checkpoint revert was best-effort. A process crash or partial provider/workspace failure could leave Git state, the Pylon projection, and the provider conversation at different turns without a durable recovery owner.

Durable rollback behavior

This adds a provider-neutral, target-absolute rollback saga with:

• atomic admission, immutable private checkpoint anchors, exact source/target CAS, and explicit turn-0 support;
• durable saga phases, owner/version fencing, canonical workspace leases, and startup reconciliation;
• bounded real-Git workspace/index/untracked/HEAD/checkpoint-ref pre-images with verified compensation;
• inspect-before-apply provider anchors, commit-last projection changes, cleanup retries, and terminal manual recovery when neither target nor compensation can be proved;
• orchestration, provider, checkpoint, session-stop, and Git mutation fences while a workspace lease is active;
• public pending/recovering/manual-recovery status only, with anchors, pre-images, receipts, and private paths excluded from public events and snapshots.

All built-in production adapters remain unsupported. This PR does not enable a rollback UI, provider-specific process work, or Prime navigation. It does not add relative rollback or queued auto-run behavior.

The three foundation commits are rebased onto faf581e6d (merged #256). The rebase preserves the server performance/coalescing work and the ownership changes from #250, #255, and #256. DurableRollbackSagas is migration 051, after pending stop 049 and the Prime recovery ledger 050; no 052 source epoch is introduced.

Verification

• vp test run <14 focused files> — 14 files, 214 tests passed
• vp run --fail-if-no-match --filter t3 test — 323 files and 4,107 tests passed; 5 files and 15 tests skipped
• vp run --fail-if-no-match --concurrency-limit 2 --filter t3 --filter @t3tools/contracts --filter @t3tools/client-runtime --filter @t3tools/web --filter @t3tools/mobile typecheck
• vp lint --report-unused-disable-directives <34 changed TypeScript files> — 0 warnings, 0 errors
• vp fmt --check <36 changed files>
• node scripts/release-smoke.ts
• git diff --check origin/pylon..HEAD
• git range-diff c908bb200..67cda0373 origin/pylon..8d909b20a

The focused coverage includes saga persistence and migration 051, exact decider/projector transitions, reactor restart reconciliation, rollback status snapshots, fault injection at persisted saga and side-effect boundaries, leases/fences, projection CAS compensation, cleanup retry, privacy canaries, linked worktrees, and real-Git restoration of tracked, staged, unstaged, untracked, renamed, deleted, symlinked, ignored-target, index, HEAD, and checkpoint-ref state.

No screenshots are included because the affordance remains hidden.

Refs #200

Implemented with OpenAI Codex GPT-5.6 Sol using the Prime Agent harness.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.4 KiB	+17 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+9 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+8 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.4 KiB	−127 B (−0.9%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+9 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−136 B (−2.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.0 KiB	57.2 KiB	−884 B (−1.5%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: faf581e · PR result: 8d909b2 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.