#21305 feat(cmux-next): durable runs, attach bridge, and top-two UI tournament

What this enables

This PR carries the durable Run/Attempt/Event API, one-use attach-ticket bridge, enrolled-worker terminal attach, typed provider/admission/routing views, and the top-two Run UI tournament judge.

The gallery workflow is now present on the feat-cmux-next base branch, so this PR should produce managed Linux screenshots and deterministic interaction receipts for agent-pane.run-board-tournament.

Tournament evidence

• Compare and Timeline are the selected top two from three independent UI worktrees.
• The judge uses the same fixtures and canonical replay/attach/approve plays.
• Current backend placement is cloud-vm -> Freestyle; Huge Blue remains explicitly adapter-pending.

Validation

• 24 focused Run-board tests passed.
• Typed Run view tests pass.
• Gallery manifest/build passed locally.
• Managed gallery evidence is expected from the PR workflow.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the durable Run control plane with fenced worker ingestion, a one-use attach-ticket bridge that opens a retained attempt in the enrolled worker's terminal, and the top-two Run board UI tournament selecting the Compare and Timeline variants. Also lands a durable agent broker with provider-neutral VM host leases, persistent workspace lifecycles with run attempt promotion, Codex voice capability negotiation, New Tab project context, an Agent Priority sidebar with motion debug tools, and a window-snapshot encoder fix.

Durable Run control plane

• Persists runs, attempts, an event log, and artifact manifests with replay cursors; worker ingestion is fenced by per-attempt HMAC credentials and lease ownership, which also rejects stale duplicate retries and terminal-retention updates and handoffs.
• Terminals stay alive for a short retention window after completion, then a cron destroys the VM; canceling a run reclaims active attempts, and a database-backed test verifies run billing scope.
• Adds a durable agent broker with effect-key idempotent jobs, generation-fenced leases, and replayable receipt journals, plus a provider-neutral VM host lease transport with an isolated workspace lifecycle queue lane; completed attempts promote into persistent runtimes behind fail-closed env composition.
• The broker worker is independently deployable and loads effect adapters from a versioned module, keeping provider code out of the broker service; a cross-host contract harness covers the broker and host lease transport.
• Adds a Huge Blue provider driver with hashed one-use relay attach tokens scoped to persistent workspaces, wired through a request-scoped, env-gated runtime composition that fails closed when credentials are absent; production relay requires per-tenant isolation and fails closed on shared relay.
• cloud-vm maps to the Freestyle backend; run creation still rejects a Huge Blue backend with adapter_not_configured.

Run board tournament

• The judge mounts Compare and Timeline against identical fixtures and replay/attach/approve plays; both scored 28/35 and advance, with the Ops Console variant held as reference only.
• The gallery workflow runs on push to the feat-cmux-next branch and produces managed Linux screenshots and deterministic receipts for agent-pane.run-board-tournament.
• CI removed stale iOS guard invocations and their fixtures.