fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/src/workers/WorkerManager.ts

@@ -11,6 +11,7 @@ import { spawn, execSync } from 'child_process'
 import type { ChildProcess } from 'child_process'
 import { WorkerProcess, type WorkerExitCode } from './WorkerProcess.js'
 import { WorkerProtocol, type WorkerMessage, type WorkerMessageType } from './WorkerProtocol.js'
+import type { WorkerResult, WorkerStatus, AgentType } from '@aircoding/contracts'
 
 export interface WorkerConfig {
   entrypoint: string       // Path to worker main.ts
@@ -28,6 +29,7 @@ export interface WorkerHandle {
   state: 'starting' | 'ready' | 'running' | 'completed' | 'error' | 'cancelled'
   started_at: string
   completed_at?: string
+  result?: WorkerResult<unknown>
 }
 
 export class WorkerManager {
@@ -148,10 +150,41 @@ export class WorkerManager {
     return this.list().some(w => w.state === 'running' || w.state === 'ready' || w.state === 'starting')
   }
 
+  /**
+   * Get the stored WorkerResult for an agent.
+   */
+  get_result(agent_id: string): WorkerResult<unknown> | undefined {
+    const handle = this.workers.get(agent_id)
+    if (!handle) return undefined
+    return handle.result
+  }
+
   // ============================================================================
   // Private
   // ============================================================================
 
+  /**
+   * Wrap a raw worker payload into a properly typed WorkerResult envelope.
+   * Provides safe defaults for any missing fields.
+   */
+  private wrap_worker_result(payload: Record<string, unknown>, handle: WorkerHandle): WorkerResult<unknown> {
+    return {
+      task_id: (payload.task_id as string) || '' as any,
+      agent_id: (payload.agent_id as string) || handle.config.agent_id as any,
+      agent_type: (payload.agent_type as AgentType) || 'executor',
+      status: (payload.status as WorkerStatus) || 'completed',
+      summary: (payload.summary as string) || '',
+      changed_files: (payload.changed_files as string[]) || [],
+      diff_ref: (payload.diff_ref as string | undefined) || undefined,
+      artifacts: (payload.artifacts as any[]) || [],
+      verification: (payload.verification as any[]) || [],
+      risks: (payload.risks as any[]) || [],
+      follow_up_tasks: (payload.follow_up_tasks as any[]) || [],
+      evidence_refs: (payload.evidence_refs as any[]) || [],
+      result: (payload.result as unknown) || null,
+    }
+  }
+
   private async wait_for_handshake(proc: WorkerProcess, config: WorkerConfig): Promise<void> {
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {