feat(agent-org): add durable pause and resume handoff

Persist Pause episodes and per-Turn handoff receipts so a Team can stop formal work immediately, drain runtimes safely, and resume only work that remains legal after restart or concurrent state changes.

Add runtime leases, generation-fenced Inbox and Task boundaries, one-shot continuation dispatch, paused Group Chat enforcement, push-driven draining UI, strict-provider task_update schemas, and rendered recovery coverage.

Verification:
- cargo test -p agent_core (3175 passed, 2 ignored)
- cargo clippy -p agent_core --all-targets -- -D warnings
- pnpm vitest run (1116 files, 8767 tests)
- pnpm typecheck and changed-file ESLint
- BuildFast packaged app with 20/20 ten-runtime Pause/Resume samples
- codexharry GPT-5.4 Mini packaged-app Pause/restart/Resume smoke

Pre-commit hook ran. Total eslint: 5, total circular: 0

Author: ShiboSheng

src-tauri/crates/agent-core/src/core/coordination/agent_inbox/store_drain.rs

@@ -303,20 +303,31 @@ impl AgentInboxStore {
     /// Used by the turn-processor drain hook after rendering the
     /// attachment, so the next turn's drain returns an empty list.
     pub fn mark_many_read(ids: &[i64]) -> Result<usize, String> {
-        Self::mark_many_read_internal(ids, None)
+        Self::mark_many_read_internal(ids, None, None)
     }
 
     /// Production acknowledgement for transcript-backed delivery. Only the
     /// Session that owns every row's durable materialization receipt may mark
     /// it read. A stale Guard from an older/replaced Session therefore cannot
     /// acknowledge a row after ownership moved elsewhere.
     pub fn mark_many_read_for_session(ids: &[i64], session_id: &str) -> Result<usize, String> {
-        Self::mark_many_read_internal(ids, Some(session_id))
+        Self::mark_many_read_internal(ids, Some(session_id), None)
+    }
+
+    /// Formal Turn acknowledgement guarded by the exact current lifecycle
+    /// generation inside the same IMMEDIATE write transaction.
+    pub fn mark_many_read_for_turn(
+        ids: &[i64],
+        session_id: &str,
+        turn_intent_id: &str,
+    ) -> Result<usize, String> {
+        Self::mark_many_read_internal(ids, Some(session_id), Some(turn_intent_id))
     }
 
     fn mark_many_read_internal(
         ids: &[i64],
         materialization_session_id: Option<&str>,
+        formal_turn_intent_id: Option<&str>,
     ) -> Result<usize, String> {
         if ids.is_empty() {
             return Ok(0);
@@ -327,6 +338,15 @@ impl AgentInboxStore {
                 let tx = conn
                     .transaction_with_behavior(rusqlite::TransactionBehavior::Immediate)
                     .map_err(|err| err.to_string())?;
+                if let (Some(session_id), Some(turn_intent_id)) =
+                    (materialization_session_id, formal_turn_intent_id)
+                {
+                    crate::coordination::agent_org_turn_contexts::validate_formal_turn_generation_with_connection(
+                        &tx,
+                        session_id,
+                        turn_intent_id,
+                    )?;
+                }
                 let now = chrono::Utc::now().to_rfc3339();
                 let mut updated = 0usize;
                 let mut changed_run_ids = HashSet::new();