feat(agent-org): add authoritative team lifecycle

[ShiboSheng]

Problem

Replaces #824.

Fixes #756.

Agent Org did not have one authoritative, restart-safe lifecycle boundary for a long-lived Team. Initial materialization, quiescence, Run View reads, watchdog recovery, and frontend polling could not yet guarantee that a Team moves safely through Starting -> Running/Idle/Failed, becomes quiet in Idle or Failed, and can later be extended without introducing another state owner.

Solution

This branch starts from origin/develop at 641c43c8a37edfb89fb5b07d61bad7083c3bca18 and contains one adapted commit only.

• Add durable Starting materialization receipts and authoritative lifecycle transitions.
• Centralize quiescence so a Team enters Idle only from committed facts.
• Keep Run View pure-read.
• Use one bounded watchdog and shared frontend polling ownership, stopping polling while hidden or otherwise non-pollable.
• Keep the redesign behind one fail-closed rollout gate.

The resulting PR1 boundary does not add Pause/Resume, Archive/Delete, the Task FSM rewrite, Writer settings, UserDirectedWork, or Group-send behavior.

Potential risks

• The redesign remains disabled by default and fail-closed. Existing rollout behavior must not be inferred to expose the new lifecycle to normal users yet.
• Lifecycle recovery spans persistence, Session state, watchdog work, and frontend polling. Focused and full automated suites pass, but the required packaged Idle performance path remains unverified on this rebuilt stack.
• The packaged test used the debug E2E fake provider. That provider can return text but cannot call the coordinator-only org_run_complete tool, so the run correctly retained completion_requested=0 and remained running under the fail-closed empty-task-board rule. This result does not establish a production lifecycle convergence defect.
• A future verification-only change should add an opt-in tool-capable fake-provider completion scenario, or rerun the scenario with a real tool-capable provider. That test work is intentionally deferred; no production-code change is currently indicated by this observation.

Architecture and performance audit

Reviewed compilation, structure, lifecycle semantics, fail-closed branches, persistence ownership, naming, wire compatibility, initialization parity, and launch/run-view resolver symmetry. The selected change keeps one bounded global watchdog, bounded recovery budgets, and shared polling ownership; it introduces no per-component polling owner or unbounded cache.

Performance verdict for this rebuilt tip is blocked, not failed: the packaged fixture did not reach a valid Idle precondition, so foreground/hidden Idle measurements cannot yet be claimed.

Verification

Passed on this PR tip:

• cargo check -p agent_core -p org2 -p session_persistence --all-targets
• cargo test -p agent_core agent_org -- --nocapture — 237 passed.
• pnpm run typecheck
• focused Vitest for agentOrgRunViewStore.test.ts — 12 passed.
• git diff --check origin/develop...HEAD
• Commit hooks, including scoped Rust Clippy.

The complete stacked tip was also verified after PR3 was added; those results are recorded in #836.

The stacked packaged app was rebuilt successfully with the redesign compiled and enabled:

• ORGII_AGENT_ORG_REDESIGN=1 WEBDRIVER=1 pnpm run tauri:build:fast -- /private/tmp/ORG2-stack-834-836.app — passed in 364.3 seconds.
• Physical macOS UI launch, Team selection, workspace selection, fake-provider/model selection, and Send all worked. The coordinator and four stable flat Member sessions materialized, and the fake-provider reply rendered.
• The rollout gate also failed closed when omitted, as intended.
• The fake provider did not issue org_run_complete; therefore this run did not exercise Running -> Idle, and no Idle foreground/hidden performance result is claimed.

cargo fmt --all -- --check reports formatting differences already present on origin/develop in untouched files. No changed file in this PR contributes to that output.

Deferred verification

• Add a narrow test-only fake-provider mode that calls org_run_complete, then emits the coordinator final answer.
• Assert completion_requested=1, committed final output, no remaining quiescence blockers, status=idle, and last_activity_outcome=completed.
• After the Team is genuinely Idle, repeat the visible five-minute, hidden five-minute, restore-revalidation, Provider/Wake, and watchdog-counter checks.
• Retain a negative test proving that an empty task board without explicit completion intent remains running.

Commit provenance

• Selected source commit 7beec790733035741ed7c5591d31e2a8264bea3b -> adapted commit 239702009cab1d60baa288a2120cfee0df1b3891, authored by Shibo Sheng.