fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/src/storage/repositories/MessageDraftRepository.ts

@@ -54,8 +54,8 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
   /**
    * Get a draft by message ID.
    */
-  async get(message_id: MessageID, _tx?: TransactionHandle): Promise<MessageDraftRecord | undefined> {
-    const stmt = this.db.prepare('SELECT * FROM message_drafts WHERE message_id = ?')
+  async get(message_id: MessageID, tx?: TransactionHandle): Promise<MessageDraftRecord | undefined> {
+    const stmt = (tx?.db ?? this.db).prepare('SELECT * FROM message_drafts WHERE message_id = ?')
     const row = stmt.get(message_id) as MessageDraftRecord | undefined
     return row
   }
@@ -63,13 +63,13 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
   /**
    * Insert a new draft.
    */
-  async insert(record: MessageDraftInsert, _tx?: TransactionHandle): Promise<void> {
+  async insert(record: MessageDraftInsert, tx?: TransactionHandle): Promise<void> {
     // Validate enum columns (only status is a closed enum for message_drafts)
     assertEnumValues('message_drafts', {
       status: record.status,
     })
 
-    const stmt = this.db.prepare(`
+    const stmt = (tx?.db ?? this.db).prepare(`
       INSERT INTO message_drafts (
         message_id, session_id, role, canonical_format,
         partial_content_json, status, created_at, updated_at, metadata_json
@@ -92,7 +92,7 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
   /**
    * Update an existing draft.
    */
-  async update(message_id: MessageID, patch: MessageDraftUpdate, _tx?: TransactionHandle): Promise<void> {
+  async update(message_id: MessageID, patch: MessageDraftUpdate, tx?: TransactionHandle): Promise<void> {
     // Validate enum columns if present (only status is a closed enum for message_drafts)
     if (patch.status !== undefined) {
       assertEnumValues('message_drafts', { status: patch.status })
@@ -123,7 +123,7 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
     }
 
     values.push(message_id)
-    const stmt = this.db.prepare(`UPDATE message_drafts SET ${fields.join(', ')} WHERE message_id = ?`)
+    const stmt = (tx?.db ?? this.db).prepare(`UPDATE message_drafts SET ${fields.join(', ')} WHERE message_id = ?`)
     stmt.run(...values)
   }
 
@@ -134,13 +134,13 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
   /**
    * Upsert a draft - insert or replace existing.
    */
-  async upsert(record: MessageDraftRecord, _tx?: TransactionHandle): Promise<void> {
+  async upsert(record: MessageDraftRecord, tx?: TransactionHandle): Promise<void> {
     // Validate enum columns (only status is a closed enum for message_drafts)
     assertEnumValues('message_drafts', {
       status: record.status,
     })
 
-    const stmt = this.db.prepare(`
+    const stmt = (tx?.db ?? this.db).prepare(`
       INSERT OR REPLACE INTO message_drafts (
         message_id, session_id, role, canonical_format,
         partial_content_json, status, created_at, updated_at, metadata_json
@@ -163,8 +163,8 @@ export class MessageDraftRepository implements Repository<MessageDraftRecord, Me
   /**
    * Delete draft for a specific message.
    */
-  async delete_for_message(message_id: MessageID, _tx?: TransactionHandle): Promise<void> {
-    const stmt = this.db.prepare('DELETE FROM message_drafts WHERE message_id = ?')
+  async delete_for_message(message_id: MessageID, tx?: TransactionHandle): Promise<void> {
+    const stmt = (tx?.db ?? this.db).prepare('DELETE FROM message_drafts WHERE message_id = ?')
     stmt.run(message_id)
   }
 }