fix: tsc 0 errors + depcruise 0 violations + all GA blockers closed

Changes (37 files, +1159/-587):
- tsconfig: moduleResolution bundler + paths alias for bun:sqlite
- bun-sqlite.ts: type shim replacing stale declare module .d.ts
- All 7 tool files: ToolDefinition alignment (version, output_schema,
  ToolPermissionSpec read_paths/write_paths, ToolCall.call_id)
- 2 adapters: ProviderAdapter implements + ProviderCapabilityMatrix shape
  (provider_kind, enabled, quality_tier, cost_tier, conversion)
- PathClassifier: 9 categories aligned (credential_store, project_air_*)
- CommandRiskAnalyzer: remove unused imports
- Recovery: Database field + scanOrphanReferences FK-off 8 invariants
- Scheduler: rebuild_from_db from session DB tasks
- ProjectionStore: 20+ event types, subscribe, rebuild from repos
- MigrationRunner: constructor accepts optional db_path
- e2e.ts: replaced hardcoded ✅ with 14 real test/check gates
- wiring.ts: eventIngestor.ingest (durable path, INV-2)
- init.ts: ToolRegistry+PermissionEngine path (INV-3)
- TUI: local ProjectionClient (INV-4)
- MainAgent: classify_via_llm with real ProviderManager invocation
- WorkerMessage: kind/session_id/agent_id/correlation_id (contracts §10)
- WorkerProcess exit code 4 = parent_cancelled

Validation gates:
- tsc --noEmit: 0 errors
- depcruise: 0 violations (28 modules)
- tests: 169/169 pass

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/src/tools/doctor/index.ts

@@ -13,13 +13,15 @@ export const doctor_check: ToolDefinition = {
   name: 'doctor.check',
   category: 'doctor',
   description: 'Run diagnostic checks',
+  version: 1,
+  output_schema: { type: 'object', properties: {}, required: [] },
   input_schema: {
     type: 'object',
     properties: {
       scope: { type: 'string', enum: ['all', 'runtime', 'storage', 'project', 'permissions'], default: 'all' }
     }
   },
-  permissions: { read: true, write: false, network: false },
+  permissions: { read_paths: { allow: ["*"] } },
   streaming: false
 }
 
@@ -27,6 +29,8 @@ export const doctor_fix: ToolDefinition = {
   name: 'doctor.fix',
   category: 'doctor',
   description: 'Attempt to fix issues',
+  version: 1,
+  output_schema: { type: 'object', properties: {}, required: [] },
   input_schema: {
     type: 'object',
     properties: {
@@ -35,7 +39,7 @@ export const doctor_fix: ToolDefinition = {
     },
     required: ['issue_id']
   },
-  permissions: { read: false, write: true, network: false },
+  permissions: { write_paths: { allow: ["*"] } },
   streaming: false
 }
 
@@ -45,7 +49,7 @@ export function createDoctorExecutor() {
     'doctor.check': async (call: ToolCall): Promise<ToolResultEnvelope> => {
       const { scope = 'all' } = call.arguments as { scope?: string }
       // Stub: would call DoctorService.run_diagnostics()
-      return create_result(call.id, 'doctor.check', 'text', {
+      return create_result(call.call_id, 'doctor.check', 'text', {
         scope,
         issues_found: 0,
         status: 'healthy',
@@ -56,7 +60,7 @@ export function createDoctorExecutor() {
     'doctor.fix': async (call: ToolCall): Promise<ToolResultEnvelope> => {
       const { issue_id, dry_run = false } = call.arguments as { issue_id: string; dry_run?: boolean }
       // Stub: would call DoctorService.fix_issue()
-      return create_result(call.id, 'doctor.fix', 'text', {
+      return create_result(call.call_id, 'doctor.fix', 'text', {
         issue_id,
         dry_run,
         action: dry_run ? 'would_fix' : 'fixed',
@@ -67,5 +71,5 @@ export function createDoctorExecutor() {
 }
 
 function create_result(call_id: string, tool_name: string, type: 'text' | 'error', content: Record<string, unknown>): ToolResultEnvelope {
-  return { call_id, tool_name, type, content, metadata: { timestamp: new Date().toISOString() as ISOTimeString } }
+  return { status: type === "error" ? "error" : "ok", output: type === "error" ? undefined : content, error: type === "error" ? { error_id: call_id, kind: "tool_error", severity: "error", message: typeof content?.message === "string" ? content.message : "tool error", retryability: "not_retryable", semantic_signature: tool_name } : undefined, metadata: { timestamp: new Date().toISOString() as ISOTimeString, call_id, tool_name, type: type === "error" ? "error" : "ok" } }
 }