Add durable project task ownership and bounded execution lanes - #10655

The task engine is now included with its first real execution/UI consumer in #10658, as requested in review. This engine-only PR is retained as a draft for source/history reference; review and land the combined task feature through #10658 after its worktree prerequisites. The combined branch runs engine regressions in its integration matrix and removes this duplicate standalone workflow.

The original engine-only scope and validation receipt follow for traceability:

Background tasks need durable ownership and dedicated child capacity before model and workspace adapters can safely use them. This adds an internal project task store and bounded runner: parents can wait for children while separate child workers continue, interrupted attempts require explicit retries, and late workers cannot publish results after losing ownership.

The layer includes atomic child-count/token reservations, retry caps, immutable snapshots, monotonic events, queued/running lease recovery, cancellation and project-retirement admission fences. Shutdown stops admission and reports workers that have not returned; a child that cannot drain leaves its parent interrupted and its project busy. The executor contract documents the required model-admission release and existing filesystem/process fences.

This is the independently reviewable engine layer requested in #9673. No renderer endpoints, model/tool adapters, owned child-worktree wiring, or UI are added here. It does not advance the held existing-folder PR #9859, replace the aggregate #9987 executor, or claim an end-to-end background coding workflow.

Validation at 191ac8ba86943eb0bd54a9f1532c5d2ed384c6c5:

• All six native jobs passed on Linux, macOS, and Windows with Python 3.11 and 3.12: run 34387110775. Each job covers 46 task-engine cases and 62 adjacent storage cases, including the actual Studio database integration.
• The same 108 cases passed locally in a clean Python 3.12 environment.
• 112 workflow-trigger regression cases passed; Ruff, repository formatting, and git diff --check passed.

The first native run exposed a racy assertion that shutdown had already flushed cancellation to SQLite, and the adjacent 900-thread storage fixture exceeded the 30-second Windows budget. The shutdown test now observes the actual cancellation signal. Storage runs with a separate 120-second budget while engine tests retain 30 seconds; no cases are skipped.

The tests cover concurrent claims and budget reservations, both parent workers waiting on children, stale results, explicit retries, shutdown/submission races, project archival/deletion, an executor that does not stop promptly, and preservation of worker capacity after an executor raises SystemExit. Real model, tool-confinement, and packaged-app qualification belong to the following integration layers.