feat(workhub): add typed action gate - #3818

Summary

Implements Slice 4 from #3492 on top of the merged Slice 3 coordination-session work:

• adds closed typed contracts for answer_here, delegate_existing, create_new, and clarify;
• exposes a bounded Runtime-owned candidate set with opaque candidate references;
• introduces a deterministic Runtime Host Action Gate for fresh target validation and execution admission;
• makes create_new the only WorkHub disposition that can create an ordinary Session;
• delegates non-destructive create and submit effects through existing Runtime Host Session authorities;
• routes the production Desktop WorkHub path through the Action Gate while retaining R2.4 only as an explicit regression-test harness.

Safety and authority boundaries

• Strategy output cannot name arbitrary Session IDs, workspaces, tools, or permission modes.
• Candidate discovery is scoped to the current Runtime Host and excludes archived, Coordination, side-conversation, and child Sessions.
• The Gate refreshes candidates before admission and rejects stale or invented references, waiting targets, self-routing, invalid creation context, and conflicting action replays.
• New ordinary Session identity is derived inside Runtime Host from the action identity; Desktop supplies only trusted workspace context.
• Successful actions are idempotently replayable; rejected admissions release the action identity so an actionable precondition can be fixed and retried.
• Tool calls and permission elevation remain owned by the target ordinary Session. The closed WorkHub action protocol provides no field that can widen either ceiling.

Slice boundary: destructive correction is deferred to Slice 5

This PR intentionally does not expose replace or Stop through the Slice 4 Action Gate.

A destructive correction is not just another routing disposition: it must prove durable linkage between the original delegation, the exact root Turn that WorkHub owns, the correcting action, and the replacement submission. That linkage and the recovery contract around the non-atomic Stop-to-submit seam must survive Runtime Host restart. Those are Slice 5 responsibilities in #3492.

Keeping only Host-lifetime ownership maps, TTLs, or retry lanes in Slice 4 would make the behavior appear safe while losing its authorization and recovery basis after restart. The chosen boundary is therefore:

• Slice 4 owns the typed gate, bounded candidates, fresh validation, action replay, and non-destructive answer_here, clarify, delegate_existing, and create_new effects.
• Slice 5 will add persistent delegation/action linkage first, then natural-language correction and exact Stop ownership on top of that durable authority.

The protocol decoder is closed and rejects a replace field. The production Action Gate has no Stop effect. Desktop does not offer a correction control; if the routing policy recognizes a natural-language cross-Session correction, production fails closed before a second delegation and tells the user to open the original Session to stop the current work. The legacy R2.4 correction path remains test-only and is not used by the application.

Verification

• Slice 4 focused Runtime Host suites: 22 passed (including 7 Action Gate tests)
• Desktop WorkHub suites: 84 passed
• Desktop production renderer build passed
• Biome check, format check, and git diff --check passed for all affected files
• Full all-workspace run was also exercised outside the sandbox: all WorkHub and Desktop tests passed; unrelated workspaces still exposed existing timing-sensitive process tests and an Eval Python-version mismatch

Closes the Slice 4 implementation items in #3492. Persistent delegation linkage, natural-language correction, and Stop/cancel behavior remain Slice 5.

AI assistance: Codex helped implement and verify this change. The commits include the required Generated-by: Codex trailer.