Keep workflow output safe and canonical

[JulioMCruz]

What changed

• Stores the project conversation id when a PM proposes a plan.
• Routes running-workflow updates back to that pinned thread instead of the latest New chat.
• Reuses the approved plan as the canonical workflow document.
• Redacts claim credentials from task results, project chat, and doc discussion messages.
• Keeps the global per-agent lease alive on heartbeats and releases it on terminal task states.

Why

The full x402 E2E produced duplicate deliverable docs, exposed a worker claim token, mixed old task updates into a new conversation, and allowed overlapping work after a lease heartbeat.

Validation

• npm test — 36 tests passed
• npm run typecheck
• npm run build

Note: npm run lint is blocked by the repository's ESLint 9 setup, which has no eslint.config.* file.