feat(background-agent): enforce durable admission

[andrei-hasna]

Why

Background-agent starts could reuse incompatible daemons, silently change requested auth profiles, race idempotent creation against quota checks, and duplicate lifecycle evidence after lost acknowledgements or restart recovery. Those gaps could start the wrong run, exceed capacity, or let stale supervisors mutate a reclaimed generation.

What changed

• Added one SQLite BEGIN IMMEDIATE create-or-adopt admission transaction with identity validation and live/recoverable capacity accounting.
• Added fail-closed package, daemon protocol, admission schema, capability, and exact auth-profile checks across CLI, TUI, app server, persisted runs, and recovery.
• Added replay-safe lifecycle receipts in the existing event journal with unique receipt keys plus bounded redacted diagnostics.
• Fenced stop, heartbeat, status, orphan, recovery, and cancellation writes by supervisor generation.
• Added deterministic state, daemon, and app-server regression coverage and documented the contract in codex-rs/background-agent/ARCHITECTURE.md.

Verification

• git diff --check
• Redacted staged and commit-range gitleaks scans
• Focused regression tests are included for create-or-adopt, identity/profile/schema conflicts, capacity, receipt replay/redaction, daemon incompatibility, and stale-generation cancellation.
• Rust build, format, and test gates run on repository CI/Blacksmith per repository policy.

Task: E-00101
Acceptance scope: codewith-durable-agent-admission-v1