#21456 feat(runs): add broker receipt projection and fail-closed lifecycle wiring

Summary

Adds the receipt-backed runtime layer on top of the durable-runs branch:

• validates broker receipt correlation, monotonic sequence, replay identity, and safe result payloads;
• projects only non-terminal attempt.* events with broker:<jobId>:<sequence> external IDs;
• wires persistent workspace lifecycle effects through the broker and explicit host lease adapter;
• adds attempt promotion boundaries with tenant/source/evidence checks and redacted views;
• keeps Huge Blue admission fail-closed when no configured host adapter exists.

This is a dependent PR for run-attach-linux and intentionally does not add credentials, SSH, production dispatch, or automatic success from broker completion.

Validation

• bun test web/tests/run-broker-receipt-projection.test.ts web/tests/run-attempt-promotion.test.ts web/tests/persistent-workspace-broker-lifecycle.test.ts — 14 passed.
• git diff --check — passed.
• ESLint invocation was attempted but the checkout resolved an incompatible ESLint/plugin combination (react/display-name API mismatch); no lint result is claimed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds broker receipt projection and fail-closed lifecycle wiring on top of run-attach-linux, persisting runtime, broker, and host lease state across layers.

• Projects non-terminal attempt.* broker receipts with broker:<jobId>:<sequence> external IDs, validating correlation, monotonic sequence, replay identity, and credential-safe result payloads; retries reuse the effect key instead of creating a second job.
• Adds a durable agent broker with lease fencing and an append-only receipt journal, plus a provider-neutral host lease transport with huge-blue and freestyle adapters; promotions fail closed without a configured host adapter, abandoned lease reservations are released, and nested lease metadata is bounded.
• Persists runtime lifecycle, lease fences, and attempt ownership on cloud_runtimes plus persistent workspace rows; runtime composition installs at startup, exposes a scoped provider assembly (with entitlements mapped into VM creation) to routes through a request-scoped seam, and stays fail-closed when configuration is missing or malformed. Workspace and promotion routes opt into authenticated composition.
• Adds an authenticated attempt promotion boundary fenced to the terminal run attempt winner (revalidating provider handles before promotion), links promoted attempts to the durable runtime, and workspace lifecycle routes return only redacted views, never provider handles, tokens, or credentials.
• Adds deterministic cross-host contract tests for the broker and host transport against in-memory fakes in the cmux-next checkout, plus route wiring tests for the scoped provider assembly.
• Does not add credentials, SSH, production dispatch, or automatic success from broker completion.

Validation

• bun test for the broker, receipt projection, promotion, runtime persistence, host lease, and route wiring suites — passed.
• git diff --check — passed.
• Test type imports, fixtures, and provider typing were adjusted for tsgo compatibility.
• ESLint was not run; the checkout resolved an incompatible ESLint/plugin combination (react/display-name API mismatch).