fix(work): harden durable recovery and TUI usage

[XuPeng-SH]

Problem

Durable Work recovery needed a verified, replayable workspace package across server, TUI, Web, and edge handoffs. The TUI also derived per-turn token metrics by subtracting mutable cumulative counters, which could underflow during reconnect or concurrent state refresh. Web decoding treated a human executor display name as a canonical identity and could crash on normal names containing spaces. Unknown skills were returned as an internal XML-oriented error instead of a clear user-facing result.

Changes

• Add content-addressed workspace recovery capture, immutable package and blob verification, deterministic replay, owner-scoped logical identity, idempotent publication, lease renewal, typed conflicts, bounded/cancellable download, and lock-safe cleanup.
• Expose the recovery contract through runtime routes, server types, thin client, SDK types/paths/client methods, and Web contract tests.
• Make TUI turn usage come from the canonical stream result and publish cumulative counters saturatingly, eliminating mutable-counter subtraction and the underflow panic.
• Keep human executor display names separate from canonical IDs; rebuild the local SDK when source/config inputs are newer so Web does not use a stale decoder.
• Make unknown-skill interception produce a concise actionable message and restore the latest /explain command documentation after rebase.
• Add an opt-in real Work journey harness: a PTY-driven TUI starts a Work, an isolated Playwright Web server discovers the same Work in Now, the TUI continues it through the Server-owned root Run, Web observes the active Run, and the Run settles after a TUI SIGHUP. Assertions use authenticated canonical Work/branch/run/event/transcript APIs, not the browser handshake.
• Add AST-based Markdown extraction matching the product renderer so Web transcript assertions validate visible content without confusing formatting markers with missing text.

Validation

• make test-offline passed: Rust workspace 21,127 passed, 628 skipped; e2e-hooks 6,064 passed, 276 skipped; SDK offline checks 340 passed, 1 skipped, typecheck, and build; Web 595 passed, typecheck, and Next build.
• Work harness contracts: 10/10 passed; Markdown live-render contracts: 5/5 passed; Playwright live config lists the real journey without starting a server implicitly.
• make format-check, make lint, make check, git diff --check, and npm ci --ignore-scripts --no-audit --no-fund --dry-run passed.
• python3 scripts/ci/validate_repository.py retains three pre-existing release-shell failures caused by the test Harbor endpoint returning HTTP 503; no new failure is introduced.

The opt-in live provider journey must run against a disposable owner token and a candidate Server whose /health build SHA exactly matches this checkout. It is intentionally reported as not tested when that setup is unavailable; Web-created Work, Web write-control/handoff, Edge/Server migration, and failed-task replacement are separate future journeys rather than claimed coverage.