feat(code): support multi-team workspace routing

[danii1]

Summary

Rewrites DEV-57 on top of #124's workspace-only worker commands. One workspace worker can now poll multiple teams, tracker accounts, or tracker products without sharing clients, credentials, cursors, or dedupe state.

This is intentionally a breaking workspace configuration change: workspace mode has not shipped to customers, so the implementation does not retain the earlier experimental shape.

Configuration model

Each [[teams]] entry defines a named tracker source:

[[teams]]
name = "platform"
tracker = "jira"
task_query = "project = PLAT AND labels = devintern"
repo = "api"
env_file = "env/platform.env"

repo is a fixed team-to-repository mapping. A fixed team ignores unscoped routing rules and cannot also have team-scoped rules.

For a team that spans several repositories, omit repo and route explicitly:

[[teams]]
name = "platform"
tracker = "jira"
task_query = "project in (PLAT, SRE) AND labels = devintern"

[[routing.rules]]
team = "platform"
repo = "api"
project = "PLAT"

[[routing.rules]]
team = "platform"
repo = "infra"
project = "SRE"

Team-scoped and unscoped rules apply to an unfixed team. Conflicting matches fail as ambiguous; no match in a multi-repo workspace fails as unrouted. A one-repo workspace retains the only-repository fallback.

Credentials compose in this order:

1. workspace .env
2. team env_file
3. inline [teams.env]

Task subprocesses also receive the selected team's tracker and identity, so comments and transitions return to the correct board.

Runtime behavior

• Builds one tracker client and change detector per team from an explicit environment map; it never swaps global process.env between team ticks.
• Namespaces polling cursors and dedupe records by tracker and team.
• Preserves the consolidated devintern worker ... command surface from refactor(code): consolidate workspace commands under worker #124; there is no standalone workspace command or --repo compatibility path.
• devintern worker connect <tracker> --team <name> uses the selected team's credentials. The team is inferred when exactly one team uses that tracker.
• Relay task envelopes currently identify only the tracker type. If several teams use the same tracker type, tracker relay registration is refused and ambiguous envelopes are ignored; isolated polling remains active. This avoids the old “first team wins” behavior. GitHub repository events are unaffected.
• Team query and fixed-repo changes live-reload. Team name, tracker, and credential changes require a restart because they rebuild source runtimes.
• Run records and scheduled dashboard retries persist both team and repository, preventing identical ticket keys on different boards from colliding or retrying in the wrong repository.
• Legacy orphan recovery fails closed when an old run cannot be attributed to a team.

Documentation

Updates the workspace, worker, relay, scaffold, and changelog documentation, including fixed-team and multi-repository-team examples, routing precedence, environment precedence, reload behavior, and the current relay limitation.

Verification

• bun run format
• bun run lint (existing warnings, zero errors)
• bun run typecheck
• bun run test — 1,338 @getdevintern/code tests pass; all monorepo packages pass
• bun run build

Base

Rebased directly onto main after #124 merged. The PR now contains one feature commit on top of the consolidated workspace-only worker command surface.

[danii1]

🔀 This branch had merge conflicts with main; devintern resolved them and pushed the merge. Please double-check the resolution.

[danii1]

🔀 This branch had merge conflicts with main; devintern resolved them and pushed the merge. Please double-check the resolution.