feat: harden durable workflow resume

[SSS135]

Summary

Adds the durable resume foundation requested in #74:

• versioned and migrated run artifacts
• stable scoped execution IDs, including nested workflows
• longest-compatible-prefix journal replay with durable suffix invalidation
• exact per-agent and aggregate usage accounting across replay
• crash-to-paused recovery and backup discovery
• cross-process run leases with stale-owner takeover
• persisted execution controls, including concurrency
• fail-closed durability boundaries
• restart and remove lifecycle controls

Recovery resumes from the last durable message or tool-result boundary.

Temporary stack

This draft builds on #83 because durable lifecycle actions extend its workflow_control contract. Review the durable commit after #83, or wait until #83 lands and this branch is rebased.

Validation

• npm test: 939/939 passed across 64 suites
• focused durable-resume suites: passed
• Biome: passed
• TypeScript build: passed
• git diff --check: passed
• repeated independent shortcut, quality, spec, and adversarial durability reviews completed; all reproduced findings were addressed

Split from and supersedes the durable-state and replay portion of #74.