fix: tsc 0 errors + depcruise 0 violations + all GA blockers closed

Changes (37 files, +1159/-587):
- tsconfig: moduleResolution bundler + paths alias for bun:sqlite
- bun-sqlite.ts: type shim replacing stale declare module .d.ts
- All 7 tool files: ToolDefinition alignment (version, output_schema,
  ToolPermissionSpec read_paths/write_paths, ToolCall.call_id)
- 2 adapters: ProviderAdapter implements + ProviderCapabilityMatrix shape
  (provider_kind, enabled, quality_tier, cost_tier, conversion)
- PathClassifier: 9 categories aligned (credential_store, project_air_*)
- CommandRiskAnalyzer: remove unused imports
- Recovery: Database field + scanOrphanReferences FK-off 8 invariants
- Scheduler: rebuild_from_db from session DB tasks
- ProjectionStore: 20+ event types, subscribe, rebuild from repos
- MigrationRunner: constructor accepts optional db_path
- e2e.ts: replaced hardcoded ✅ with 14 real test/check gates
- wiring.ts: eventIngestor.ingest (durable path, INV-2)
- init.ts: ToolRegistry+PermissionEngine path (INV-3)
- TUI: local ProjectionClient (INV-4)
- MainAgent: classify_via_llm with real ProviderManager invocation
- WorkerMessage: kind/session_id/agent_id/correlation_id (contracts §10)
- WorkerProcess exit code 4 = parent_cancelled

Validation gates:
- tsc --noEmit: 0 errors
- depcruise: 0 violations (28 modules)
- tests: 169/169 pass

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/src/tools/ToolRegistry.ts

@@ -87,13 +87,13 @@ export class ToolRegistry {
     // Step 1: Lookup tool definition
     const definition = this.tools.get(call.name)
     if (!definition) {
-      return create_error_result(call.id, 'tool_not_found', `Tool ${call.name} not found`)
+      return create_error_result(call.call_id, 'tool_not_found', `Tool ${call.name} not found`)
     }
 
     // Step 2: Validate input schema
     const validation = this.validate_input(call, definition)
     if (!validation.valid) {
-      return create_error_result(call.id, 'invalid_input', validation.error || 'Invalid input')
+      return create_error_result(call.call_id, 'invalid_input', validation.error || 'Invalid input')
     }
 
     // Step 3: Build permission context
@@ -112,7 +112,7 @@ export class ToolRegistry {
 
       return result
     } catch (error) {
-      return create_error_result(call.id, 'execution_error', error instanceof Error ? error.message : String(error))
+      return create_error_result(call.call_id, 'execution_error', error instanceof Error ? error.message : String(error))
     }
   }
 
@@ -132,7 +132,7 @@ export class ToolRegistry {
     // For streaming tools, we need to get the executor
     const executor = this.executors.get(call.name)
     if (!executor) {
-      yield create_error_result(call.id, 'executor_not_found', 'Executor not registered')
+      yield create_error_result(call.call_id, 'executor_not_found', 'Executor not registered')
       return
     }
 
@@ -141,7 +141,7 @@ export class ToolRegistry {
     const decision = await this.permission_engine.evaluate(call, permission_context, definition)
 
     if (decision.action !== 'allow') {
-      yield create_error_result(call.id, 'permission_denied', decision.reason)
+      yield create_error_result(call.call_id, 'permission_denied', decision.reason)
       return
     }
 
@@ -150,7 +150,8 @@ export class ToolRegistry {
     let final_result: ToolResultEnvelope | undefined
 
     for await (const chunk of this.execute_streaming(call, context, executor)) {
-      if (chunk.type === 'final') {
+      // Streaming signal: final result is the one with status='ok' whose metadata marks final
+      if (chunk.metadata && (chunk.metadata as any).is_final === true) {
         final_result = chunk
       } else {
         yield chunk
@@ -161,7 +162,7 @@ export class ToolRegistry {
     if (final_result) {
       yield final_result
     } else {
-      yield create_error_result(call.id, 'no_final_result', 'Streaming tool did not produce final result')
+      yield create_error_result(call.call_id, 'no_final_result', 'Streaming tool did not produce final result')
     }
   }
 
@@ -248,7 +249,7 @@ export class ToolRegistry {
       case 'allow': {
         const executor = this.executors.get(call.name)
         if (!executor) {
-          return create_error_result(call.id, 'executor_not_found', 'Executor not registered')
+          return create_error_result(call.call_id, 'executor_not_found', 'Executor not registered')
         }
         return executor(call, ctx)
       }
@@ -257,7 +258,7 @@ export class ToolRegistry {
         // Emit visible notice, then execute unless interrupted
         const executor = this.executors.get(call.name)
         if (!executor) {
-          return create_error_result(call.id, 'executor_not_found', 'Executor not registered')
+          return create_error_result(call.call_id, 'executor_not_found', 'Executor not registered')
         }
         const result = await executor(call, ctx)
         return {
@@ -275,16 +276,16 @@ export class ToolRegistry {
 
       case 'block': {
         // Return blocked outcome → task.blocked upstream
-        return create_error_result(call.id, 'blocked', `Action blocked: ${decision.reason}`)
+        return create_error_result(call.call_id, 'blocked', `Action blocked: ${decision.reason}`)
       }
 
       case 'refuse': {
         // Return policy error; no execution
-        return create_error_result(call.id, 'policy_error', `Refused: ${decision.reason}`)
+        return create_error_result(call.call_id, 'policy_error', `Refused: ${decision.reason}`)
       }
 
       default:
-        return create_error_result(call.id, 'invalid_decision', `Unknown action: ${decision.action}`)
+        return create_error_result(call.call_id, 'invalid_decision', `Unknown action: ${decision.action}`)
     }
   }
 
@@ -313,10 +314,15 @@ export function createToolRegistry(project_root: string): ToolRegistry {
 
 function create_error_result(call_id: string, error_type: string, message: string): ToolResultEnvelope {
   return {
-    call_id,
-    tool_name: '',
-    type: 'error',
-    content: { error_type, message },
-    metadata: { timestamp: new Date().toISOString() as ISOTimeString }
+    status: 'error',
+    error: {
+      error_id: call_id,
+      kind: error_type === 'not_found' ? 'unknown_error' : 'tool_error',
+      severity: 'error',
+      message,
+      retryability: 'not_retryable',
+      semantic_signature: error_type,
+    },
+    metadata: { timestamp: new Date().toISOString() as ISOTimeString, call_id }
   }
 }