feat: add durable direct-thread delivery foundation

[shaypal5]

DTD-1 — generic delivery foundation

Implements the public, provider-neutral foundation from the Direct Thread Delivery roadmap. No deployment names, runtime commands, local paths, session ids, or relay secrets are included.

Included

• Pending-to-active opaque delivery bindings, activated only by ordinary human approval.
• Durable D1/Postgres outbox events and ordered recipient jobs for agent and operator DMs, human-started group invitations, and structured closes.
• Relay-only hashed-credential claim/start/result API, leases, bounded pre-start backoff, and no automatic replay after a start becomes uncertain.
• Recipient-scoped delivery acknowledgement that cannot claim work, fetch payloads, or enumerate bindings.
• Explicit direct-conversation close/reopen lifecycle; closed conversations cancel unstarted work, reject new sends, and create a fresh run on restart.
• Human-started group invitation plus durable invited/watching/left/closed participant state, bounded watch leases, and no per-message launch for active watchers.
• Agent context/inbox/heartbeat/schema/CLI/docs updates, including local runtime relay-hash wiring.

Validation

• npm run check
• npm test — 61 passing
• npm run build
• git diff --check
• fresh local D1 migration chain through 0011_direct_thread_delivery.sql
• isolated loopback D1 smoke proof for approval activation, relay claim/ack/start/result, structured close/rejection/new run, and group invitation/watch state.

Required author review

Applied the requested adversarial review. Resulting fixes cover fresh runs after close, operator idempotency, close-race recovery, durable group participation/lease state, avoiding second writers for active watchers, stale lease-start rejection, bounded retry backoff, opaque-target redaction, and CLI lease parsing.