delivery: unify background completion inbox contract

[testikun]

Problem

Closes #160.

Direct Subagent, Background Terminal, and Workflow each maintained a separate pending/consume/retry gate. Their execution states should remain producer-owned, but delivery identity, Session ownership, generation fencing, and atomic consumption had drifted across three implementations.

Value

A single small contract now proves the shared delivery invariants once: completions cannot cross Session owners or generations, explicit consumption races automatic delivery through one gate, failed batches retain exact identity and order, and dead letters remain inspectable. Producer-specific lifecycle and wake behavior remain unchanged.

Approach

• Add a shared in-process completion inbox with stable delivery ids, Pi SessionManager owner generations, producer identity, terminal references, pending/in-flight claims, acknowledgement/retry, and fail-closed dead letters.
• Migrate Direct Subagent and Background Terminal adapters off their private pending maps while preserving their existing follow-up and next-turn policies.
• Migrate Workflow's in-memory gate while retaining its durable per-run receipts, partial acknowledgement, persistence recovery, and at-least-once replay contract.
• Persist Workflow owner identity and epoch through bounded projections. Same-Session restart is an explicit revival boundary; stale predecessor instances and cross-Session restores cannot append to the revived transcript.
• Record the four-layer boundary and validation contract in docs/design/COMPLETION_INBOX.md.

Validation

• bun run check — passed.
• bun run test — 1,253 passed, 0 failed, 1 skipped; Vitest 30 passed.
• Node 22 node scripts/run-tests.mjs — 1,253 passed, 0 failed, 1 skipped; Vitest 30 passed.
• Focused shared inbox, Workflow delivery, and Workflow lifecycle e2e run — 40 passed, 0 failed.

Impact

• User-visible behavior: stale background completions are no longer eligible to enter a replacement Session; normal completion messages and wake policies are unchanged.
• Model-visible context/tools: no schema or tool changes.
• Runtime/lifecycle: all three producers use the shared owner/epoch/consumption gate; each producer still owns execution, cancellation, and terminal facts.
• Persisted data: Workflow delivery records gain optional ownerSessionId and ownerEpoch; legacy records restore compatibly.
• UI: no component or visual change; a screenshot is not applicable.
• Risk: transport acceptance is not presented as distributed exactly-once. Workflow deliberately remains at-least-once when transport succeeds but durable receipt persistence fails.