feat(backend): push manager_worker coop-group events and structure ClawMind execution_graph

[jiangj0627]

Problem

• The ClawMind callback's execution_graph was a raw passthrough of ext_info ({flow_runs, node_executions}), not a structured TaskExecutionGraph. The DAG encoded in each node's
  input_json.nodeOutputKeys was never turned into relations/edges, so the dashboard received the raw envelope, and the bogus succeeded_count was surfaced verbatim.
• manager_worker collaboration groups had no event stream: the group was created without subscribing, so §4 events were never pushed back, apply_manager_worker_event was dormant, the dashboard had
  no audit snapshot, and terminal convergence relied solely on the result poller (the state after commit fa6c1f067 removed inline subscriptions). The manager_worker group event stream is now required.
• The collaboration-group type could only be derived implicitly from has_yaml (state_machine/manager_worker); there was no way to explicitly select chat/manager_worker.
• Creating a group needs the driver-bot's Bearer token as caller identity (per the ocb model), but BCS exposes no "fetch token" HTTP API, so a production-grade token provider was missing.

Solution

Across two commits:

1. fe0f2bbff

• ClawMind execution_graph → graph_to_dict-shaped TaskExecutionGraph: new _build_claw_mind_execution_graph converts flow_runs/node_executions into {run_id, task_id, loop_round, status, output, extend_props, tasks[], relations[]}. relations are derived from each node's input_json.nodeOutputKeys (multi-parent DAG, dangling edges filtered out); the low-level status is mapped to
  the 7-state Status enum; rich fields (token_usage/timing/executor_type/input) are folded into run_info.extend_props. Secrets/digests/version (credentials_json/identity_key/plugin_version) are
  excluded, and the bogus graph-level succeeded_count is dropped (nodes are the authoritative source). The adapter does not import repository serializers — it hand-writes the same dict shape
  (comment-marked to keep in sync) and only reuses the domain Status enum.
• ZdasBcsBotTokenProvider: reads bcs_bots.session_token directly via the prod DatabasePlugin (ZDAS agentclawdb_ds, same DB as bcs_bots), wrapped in CachingBcsBotTokenProvider (TTL), and
  wired as the default in task_module. This supplies the caller_bot_token (Authorization: Bearer) driver-bot caller identity for create_group. Locally there is no bcs_bots table → the query
  error is swallowed → None (no Bearer sent; local BCS ignores auth, harmless).
• Updated the previously locked-in assertion execution_graph == ext_info in test_callback_adapter / test_task_callback_report to the structured-shape assertion.

2. 3831eb7b7

• execution_config.group_kind (additive, non-breaking): _run_yaml derives collab_mode as: yaml body present → state_machine (group_kind not consulted, existing logic unchanged); no yaml →
  group_kind=chat (new exit), None/manager_worker → manager_worker (unchanged), state_machine without yaml / unknown value → ValueError.
• manager_worker groups now always inline-attach a §4 event_subscriptions (in the manager_worker branch of form_coop_group): event_filters = group.created/session.created/task.assigned/task.completed/session.completed, payload.mode = full, sink.url = {api_base_url}/api/v1/collaboration/tasks/callback/report. BCS pushes these back,
  activating the existing apply_manager_worker_event → task_callback.execution_graph audit snapshot + converge_by_session terminal convergence. state_machine/chat do not attach (the existing
  negative test test_form_coop_group_does_not_attach_event_subscriptions is untouched and still passes). Auth stays HMAC + existing caller_bot_token (Bearer), no cookie; if _api_base_url is unset,
  subscriptions are skipped with a warning and the poller remains the convergence fallback.

Validation

• Directly-relevant suites: 132 passed (translator, execute_task_type_branching, test_state_machine, test_executor_e2e, callback_adapter, task_callback_report, bcs_bot_token_provider).
• Wider scope (task_center + task_runner + adapters/http/task + dashboard): 356 passed, 5 skipped.
• New/changed tests green (TDD red→green): 6 group_kind cases; manager_worker subscriptions (attached / skipped without api_base_url / not attached for chat); end-to-end execute → engine → form_coop_group → create_group attaching the §4 subscription; existing state_machine negative test still green.
• SAST (ruff blocklist-equivalent: E902/E117/F405/E712/E701/E702/F821/F822/F823) clean on all changed files.

Compatibility and risk

• ClawMind execution_graph shape change: from raw {flow_runs, node_executions} to a structured TaskExecutionGraph dict. The only consumer today is the dashboard passthrough
  (graph.execution_graph = rec.execution_graph) with no hard parser downstream, so there is no breaking consumer.
• manager_worker group creation now attaches a subscription + triggers require_human: the auth assumption is that Bearer (+HMAC) satisfies require_human without a cookie. This contradicts
  the older memory bcs-create-group-auth-model finding (Bearer→403). Live BCS validation is required; if rejected, the fallback is to add a cookie path for manager_worker (deliberately not done
  here).
• Event stream depends on an absolute sink.url: if _api_base_url is unset, subscriptions are skipped (poller convergence fallback, no audit snapshot).
• group_kind is non-breaking: existing has_yaml → state_machine/manager_worker callers are unaffected; it only adds a chat exit and explicit selection when no yaml is present.
• The subscription attaches for all manager_worker groups (both the group_kind explicit path and dynamic dispatch), decided by mode in form_coop_group; chat/state_machine do not attach.

Related

• Reference: 语雀《BCS Group 回调接入说明》zeodup/vh3397/yt7ekehen7dpuyeq (§1 create-group subscriptions, §4 manager_worker events).
• Note: for manager_worker this effectively rolls back commit fa6c1f067's "remove inline subscriptions"; state_machine/chat are unchanged.