feat(db): add canonical agent identity projection

[andrei-hasna]

Summary

• add the additive Todos agent identity projection aligned to hasna.identities.agent-identity/v1 version 1 at hasna/identities commit 557fc2228722b7505071cd08d2109906664637ee (PR feat: add canonical identity and scoped auth contracts identities#14)
• vendor the offline conformance fixture docs/fixtures/agent-identity-v1.conformance.json as src/db/fixtures/agent-identity-v1.conformance.json, fixture id hasna.identities.agent-identity/v1/conformance/1, SHA-256 2d22e72b7315d0b06b3c67c71674cfd8c2dff552727eea00efb325f52c9420af
• store immutable canonical identity authority plus structured nullable metadata and append-only, fully-qualified source-lineage history
• quarantine non-authoritative/name-similarity candidates, fail ambiguous alias/source resolution closed with IDENTITY_ALIAS_AMBIGUOUS, and keep names display-only
• make generated-name normalization a non-mutating planning path: it performs zero agents.name updates and zero historical reference rewrites, while appending only quarantined candidate aliases
• keep existing task, queue, metrics, comment, lock, label, and local-ID references discoverable unchanged
• keep the Todos consumer rollout default explicitly legacy_first; canary is deterministic canonical_first, rollback is deterministic legacy_first, and both retain additive evidence/history

Safety and ownership

• Runtime Coordination remains the external logical owner of leases/fences; no lease/fence behavior was changed
• migration 65 is additive; same-lineage promotion, correction, and retirement append a new revision while immutable prior identity, evidence, and history remain intact
• excluded coordination/routing/CLI/server/MCP/generated/package/release files are unchanged from origin/main
• no unpublished package, network runtime dependency, or machine-local foundation path is imported
• no live migration, real canary, publish, install, deployment, rollout, merge, or Todos/Conversations/Mementos record mutation was performed

Verification

• bun test src/db/identity-conformance.test.ts src/db/identity-mapping.test.ts src/db/agents.test.ts src/db/database.test.ts — 105 pass, 0 fail
• bun test — 2639 pass, 18 environment-gated skips, 0 fail across 199 files
• bun run typecheck — pass
• bun run build — pass
• git diff --check — pass
• protected-source and strict-write-set assertions against origin/main — pass
• staged and origin/main..HEAD gitleaks scans — no leaks
• fresh independent exact-head review of 5359a85 — PASS, no P0/P1 findings
• reviewer focused tests: 72 pass; two pre-assertion EROFS mkdtemp failures were explicitly classified as read-only /tmp reviewer-environment artifacts and are covered by the green exact-head local suites above

Rollback

Switch the consumer read preference to legacy_first. Additive columns, lineage revisions, aliases, and evidence remain retained; rollback does not destructively remove schema or history. Generated-name normalization remains non-mutating until an alias-aware consumer rollout is separately implemented and proven.