feat(runtime): add managed DIRECT worker authority

[0YHR0]

A4.1b.1 scope

This Draft PR cuts over only newly admitted, deterministic DIRECT Runs in CI/test environments from legacy authority to the persisted managed Runtime authority selected by A4.1a. Worker routing uses the immutable TaskRun.runtime_authority; it never re-evaluates the admission gate and never falls back to the legacy runner.

Authority and transaction changes

• Adds explicit Task/Run RECONCILIATION_REQUIRED and Attempt OUTCOME_UNKNOWN states with no ordinary exit.
• Uses Run/intent-stable assignment and dispatch identities across replacement Attempts.
• Persists prepare, fenced claim, and DISPATCHING in short transactions, with all adapter/provider calls outside database transactions.
• Atomically records the terminal Runtime observation with Task/Run/Attempt finalization, conservative budget settlement, quota release, Inbox dedupe, and reconciliation Outbox evidence.
• Accepts only mapping output with empty usage in this slice; unsupported successful results fail closed without inventing pricing lineage.

Crash windows and recovery

• PREPARED + expired owner is safe to reclaim with a replacement Attempt and the same execution/dispatch identity.
• DISPATCHING or later + expired owner and reattach=false is never redispatched. The old owner/fence records deterministic control-plane uncertainty and parks Runtime, Task, Run, and Attempt atomically.
• Provider exception, response loss, identity mismatch, OUTCOME_UNKNOWN, or LOST requires reconciliation rather than blind retry.
• Commit-response/message replay is Inbox-idempotent and does not duplicate provider dispatch, observation, Attempt, or reconciliation event.
• A4.1b.2's privileged evidence-driven reconcile command is intentionally out of scope; no other transition exits the parked state.

Rollout and rollback

managed_runtime_direct_cutover remains absent from default profiles, restricted to test/testing with the deterministic provider, and disabled on the test server. Disabling it changes admission for new Runs only. Existing managed Runs must retain the managed worker/runtime configuration until terminal or parked; rewriting authority or falling back to legacy is prohibited.

Validation

Local:

• Ruff: passed
• git diff --check: passed
• Managed Runtime/Worker/domain targeted suite: 70 passed
• New PostgreSQL module collects locally (4 skipped because Docker/PostgreSQL is unavailable in the desktop sandbox)
• Full local pytest was not used as release evidence because the Windows sandbox cannot complete the named-pipe subprocess tail; the required full unit/coverage, PostgreSQL, and Compose suites passed in GitHub Actions

GitHub PostgreSQL CI provides real transaction evidence for:

• authoritative success plus exact replay
• rollback after observation insertion before commit
• expired DISPATCHING owner atomic parking, conservative budget and quota release
• stale-fence parking rollback

Out of scope

• A4.1b.2 reconcile command
• reviewed/coordinated/federated authority cutover (A4.2)
• generic subprocess authority
• production durable reattach/runtime backend and production rollout (A4.3)
• closing [P0] Define framework-neutral Managed Agent Runtime API v0.1 #135 or [P0] Prove framework neutrality with a non-LangGraph managed Agent #136