fix(execution): wire resumeExecution resolver and guard the gap

[gibbsie]

Summary

resumeExecution shipped in the durable-execution change as a declared Mutation with a tested handler - but no AppSync resolver was ever wired to the field, so calls returned null in dev. Post-deploy verification caught it. The handler tests, CI, and synth all passed because nothing asserted that a schema field has a resolver behind it, so this PR fixes the field and closes the class of defect that hid it. Also included: reconciliation of the timeout watchdog's IAM grants, which verification flagged as diverging from what was recorded.

What changed

Resolver wiring + parity guard (bc01b54)

• Mutation.resumeExecution is wired to the execution data source, structurally identical to startExecution (same data source, UNIT kind, same request and response templates) - confirmed by comparing the synthesized resources, not just the source.
• New generic guard test: it parses every Mutation and Query field from the schema and asserts a corresponding AppSync Resolver exists in the synthesized template, with a documented allowlist for anything intentionally unwired. Proven to bite: the new resolver was temporarily removed and the guard failed on exactly Mutation.resumeExecution, then restored.
• Plus a targeted template assertion for this specific field.
  Watchdog IAM reconciliation (8432733)
• Verification found the watchdog role holding Scan and UpdateItem on the executions table where the design decision said reads-only. Source and history reconciliation showed the decision text was the inaccurate artifact: Scan pre-dates this work (it is how running executions are enumerated - there is no status index to Query instead), and UpdateItem is genuinely required, since reconcile-or-fail writes node transitions and finalize through the shared conditional guards.
• Genuinely unused dynamodb: Query' grants were removed from both the executions and workflows grants. The recorded decision has been amended to the verified minimal set.

Testing

• tsc --noEmit clean; full backend suite 6,802 tests passing across 441 suites (one pre-existing env-gated integration skip).
• Parity guard: 242 assertions, with the red-proof described above.
• Both affected stacks synth clean; the worker's attribute-restricted UpdateItem grant is byte-identical to main - this branch does not touch it.
• Arbiter stepRunner pytest green; no Python changed (consistent with removing grants that were never called).

Deployment notes

One new AppSync resolver and a narrowing of watchdog IAM. No new resources, no schema change. After deploy, resumeExecution should appear in the live resolver list - that live check is what closes the originating finding, since a resolver in a template is not proof that dev serves it.