Harden approval-gated code execution and recovery

[dovvnloading]

Summary

• Disable the local process capability until Cortex can enforce native filesystem and network isolation; requests now fail closed before a job is created.
• Make completion, failure, cancellation, recovery leases, and workspace cleanup concurrency-safe so a losing coordinator cannot overwrite or delete another live attempt.
• Require the task tray to load, hash, and metadata-match generated source before enabling one-time approval, while keeping denial available on verification failure.
• Keep actionable, unexpired approvals visible ahead of terminal history.
• Add a bounded coding-agent hardening roadmap covering durable runs, transactional workspaces, policy enforcement, checkpoints, verification, and parallel isolation.

Why

The existing feature is an approval-gated bounded Python runner, not yet a repository coding agent. The audit found several reliability boundaries that needed to be closed before expanding it:

• Job Objects constrained resources but did not remove a subprocess's ambient host authority.
• Cancellation and late worker completion/failure could race across separate database writes.
• Supervisor leases were not renewed, and losing coordinators could misclassify or interfere with live work.
• Approval could be enabled without cryptographically verifying the displayed source.
• Newer history records could hide an older approval that still required user action.

Implementation notes

• Process access intentionally returns HTTP 422 with process_capability_unavailable; filesystem/network code remains within the existing bounded worker.
• Guarded repository transitions preserve the first committed terminal ordering.
• Supervisor heartbeat shutdown/restart is fenced, and workspace cleanup occurs only while the owning job lease is still held.
• Approval source verification binds job ID, language, digest, intent, capabilities, and the SHA-256 hash of the actual UTF-8 source bytes.
• No database migration or dependency change is required.

Validation

• Backend: 555 passed, 1 platform-specific skip (aggregate full suite plus native qualification)
• Native Windows AppContainer qualification: passed under the normal Windows account
• Ruff: passed for backend and tests
• TypeScript typecheck: passed
• ESLint: passed
• Frontend unit tests: 27 files, 173 tests passed
• Playwright: 18 scenarios passed
• Production frontend build: passed (existing bundle-size advisory only)
• Independent final-diff review: no remaining correctness or security blockers

Follow-up boundary

This PR deliberately does not claim full coding-agent parity. The remaining transactional run engine and workspace-agent work is sequenced with release gates in docs/CODING_AGENT_HARDENING_ROADMAP.md so future passes remain finite and auditable.