feat: deliver forum conference control signals

[shaypal5]

Summary

• add a provider-neutral, durable wake-up outbox for forum-conference participant add, Go, and Stop actions
• expose relay-only claim, started, and result endpoints plus ordinary agent receipt acknowledgement
• show sanitized per-participant delivery status in the operator dashboard without treating receipt as a continuing online-presence claim
• add D1/Postgres migrations, documentation, and coverage for lifecycle supersession and telemetry redaction

Verification

• npm run check
• npm test
• npm run build
• dashboard browser smoke check in demo mode

Privacy and safety

This is generic public-core capability. It contains no deployment names, private paths, tokens, runtime UUIDs, or relay targets.

[shaypal5]

Author self-review

I reviewed this PR as an outsider using the requested standard: pretend I am a senior developer who strongly dislikes the implementation, be brutally honest, and make it better.

Issues found, recommended action, and result

1. A pre-start waiting wake-up could linger after Go or Stop. Recommendation: cancel queued, retry, deferred, and pre-start leased work when a conference advances; keep any already-started work explicitly uncertain rather than replaying it. Applied in 0ebadbc.
2. An idempotent replay of Go after a conference had stopped could create a fresh Go wake-up for a newly revised binding. Recommendation: preserve the historical Go response, but enqueue delivery only when the resulting session is actually active. Applied in 0ff2bba, with regression coverage.
3. The dashboard must not imply agent presence from a transport event. Recommendation: surface only sanitized delivery and acknowledgement state, label acknowledgement as receipt, and cover bootstrap redaction. Applied with UI copy and tests.
4. The generic API documentation initially described direct-message ordering too broadly. Recommendation: distinguish ordered direct-message delivery from state-bound forum-conference wake-ups. Applied in 0ff2bba.

Final verification on the pushed head: npm run check, npm test, npm run build, browser smoke check, and passing GitHub Actions CI.