fix: address 19 review findings across workers, claims, UI, and board reads

[seanperkins]

The review found paths that could bypass delivery protection, close valid PRs on Git errors, trust fork branch names, release replacement claims, or apply UI actions to the wrong issue. It also found restart recovery gaps and unbounded board reads.

This PR combines the fixes produced by six subagents, with targeted regressions and cross-review.

Workstream	Issues
Delivery protection, Git failure handling, durable worker publication	#245, #246, #255
Trusted PR declarations, revocation replay, service mutation restrictions	#247, #252, #260
Claim transitions, reassignment, and lease generation safety	#248, #249, #256
Review shortcuts, issue navigation, PR promotion, attachment retries	#250, #251, #258, #259
PR reopening/order reconciliation and serialized webhook dispatch	#253, #254, #257
Reverse indexes, scoped enrichment, compact paginated board reads	#261, #262, #263

Validation

• 2,177 tests passed across 174 files; none skipped.
• Lint: 0 errors, 393 warnings; formatting and both app/UI typechecks passed.
• UI production build and git diff checks passed.
• Node 24.19.0, npm 11.9.0; Yarn 1.22.22 supplied for package-manager guard tests. The suite used a 20-second per-test timeout for the npm subprocess test.
• Every published commit's tree hash matches its validated local counterpart. Final tree: f767cf9ec9c8b5f269fd7aa4c1237129d0912930.

On the synthetic 10,000-issue / 199,960-event fixture, task selection fell from about 3.56 seconds to 5.45–5.94 ms. An empty-project issue list fell from 95–98 ms to 1.04–1.34 ms. Default board payload was 715 bytes and the first all-history page was 10,270 bytes, compared with the previous roughly 25 MB response. These are local benchmark measurements. Legacy full /issues and MCP search responses remain compatible.

Migration and rollout

• 0020_review_performance adds mechanical indexes through the existing migration mechanism. PR feat: a human-only gate that actually requires a human act (SYD-281) #243 also adds migration 0020: whichever PR merges second must reconcile/regenerate the SQL, journal, and snapshot together before deployment. This PR stands alone on current main.
• Previously branch-inferred confirmed PR links remain because legitimate and forged historical links cannot be safely distinguished automatically. A human should audit suspicious active delivers links attributed to the synthetic github actor and revoke incorrect relationships.
• Unpublished branches whose sessions were already swept before installation have no durable outbox marker and need manual recovery. New dispatches persist an obligation before launch and retain it until publication and tracker observation succeed.
• Webhook serialization follows the current single-server-process, single-database-connection architecture.
• PR feat: precompile host scripts, run one plain node process per service (SYD-268) #244 is unchanged. No live workers, merges, or deployments were run.

Issue closure

Closes #245
Closes #246
Closes #247
Closes #248
Closes #249
Closes #250
Closes #251
Closes #252
Closes #253
Closes #254
Closes #255
Closes #256
Closes #257
Closes #258
Closes #259
Closes #260
Closes #261
Closes #262
Closes #263