feat: add attended local delivery lifecycle

[davidahmann]

Summary

• add schema-versioned task, context, evidence, and review contracts plus user-only SQLite lifecycle state
• build in an exact-base disposable worktree, create a lifecycle-owned local commit, validate declared commands in a digest-pinned no-network OCI container, and review the exact candidate in fresh read-only Codex context
• add attended run, qualify, verify, review, resume, cancel, backup, restore, purge, status, and support-bundle CLI paths with bounded deadlines, output, retries, cancellation, cleanup, and immutable input checks
• make the trust ceiling explicit: inspect-only operation cannot invoke baseline qualification or Codex building; builder authority uses workspace-write with approval policy never and no automatic escalation
• enforce one persisted absolute run deadline across image preflight, validation, retries, resume, and review; keep only best-effort safety cleanup on a fresh bounded deadline
• keep automated dependency updates within the qualified Node 24 and TypeScript 6 major boundaries; stale incompatible Dependabot PR chore(deps-dev): Bump the development group with 2 updates #2 was closed

Validation

• Node 24.20.0 / npm 11.19.0: npm run check
• 17 test files and 104 tests passed
• coverage: 89.86% statements, 80.92% branches, 97.27% functions, 90.22% lines
• workflow contract and packed disposable-repository lifecycle canary passed
• baseline interruption, trust-ceiling, exact-deadline, fault, cancellation, cleanup, and CodeQL-safe test-harness paths covered
• DCO passed for the one signed commit
• exact-head local Codex review converged after systemic repair rounds; the sole remaining result is the accepted standalone P2 below

Bounded accepted debt

• OCI verification currently rejects in practice a checkout/state path containing a comma because Docker long-form --mount uses commas as delimiters. This is a standalone P2 portability edge case and is accepted for this pre-alpha head under the maintainer review-convergence rule.
• Restoring an older state backup can leave newer disposable worktrees outside the restored database inventory. Restore remains explicit and local; reconciliation of those later worktrees is tracked as pre-alpha lifecycle debt.

Trust boundary

This is attended trusted-host execution. Mill does not claim hostile-host, keychain, credential, unrelated-filesystem, or network containment for the Codex process. OCI validation is the isolated deterministic gate. Wave 2 does not push candidate branches, open downstream PRs, merge, or deploy.

Assistance

Designed, implemented, tested, and reviewed with Codex under the repository workflow. David Ahmann remains the human readiness and merge gate.