feat: adopt personal provider sessions - #113

Summary

Adopt eligible personal Codex and Claude conversations as ordinary HRA sessions, including exact conversation targets of present active or paused Codex Desktop heartbeats outside the ordinary recency window. Adopted sessions receive the same public shape and provider-supported queue, HRA session tasks, Work, autorespond, and approval authority as native sessions.

Codex Desktop retains ownership and execution of its heartbeat. HRA adopts the target conversation without importing schedule metadata or converting the heartbeat into an HRA session task. Standalone Desktop cron tasks have no stable target conversation and do not qualify.

Authority and compatibility

• Scheduled targeting waives age only. Account, project, liveness, quiescence, collision, and exact-thread checks apply around admission; deletion or retargeting removes the waiver.
• Exact account, provider generation, connection, thread, and runtime custody fence both controllers. Native and adopted sessions use the same approval policy.
• Provider deletion atomically terminalizes the session, pauses its active HRA task, and releases the exact personal controller. Late accepted Work receipts cannot resurrect stale attempts.
• Schema v40 preserves historical v39 authority and upgrades safely under SQLite 3.53 trigger revalidation.
• Private automation details and adoption provenance remain excluded from CLI and cloud projections.
• CI provisions sufficient heap for typed ESLint on the expanded project graph.

Validation

• Final commit: 066296513422f6c6bbecd0eff208283e051e04cb.
• Full bun run check through the installed host scheduler with NODE_OPTIONS=--max-old-space-size=4096: 2,775 tests passed, plus lint, typecheck, site/app/CLI builds, package inventory, isolated local/global installation, and daemon lifecycle.
• Fresh macOS, Ubuntu, Required, and CodeQL checks passed.
• Independent adversarial reviews and focused regressions cover scheduled targets, privacy, migrations, approvals, provider deletion, controller custody, restart, and late Work settlement.

Providers expose no global exclusive lease. Codex uses the accepted ten-minute inactivity inference, and an external client can still race a later resume.

Package release, tagging, and manual activation are outside this change.