[codex] Add AgentTask task controller reconcile loop

[windoliver]

Summary

Closes #299.

Implements the D2 AgentTask task controller scope in one PR:

• Adds the core TaskController and DefaultTaskBinder for AgentTask reconciliation, binding, retries, lifecycle start/stop, resync, and status transitions.
• Adds AgentTask watch/informer support, resourceVersion behavior, local SQLite write fan-out, HTTP AgentTask list/watch fan-out, and server startup wiring.
• Wires server-side AgentTask store writes so controller-owned status patches publish watch events and enqueue task IDs immediately, without duplicate route fan-out.
• Handles live Running reattach catch-up for stale observed generation / Running condition metadata.
• Adds focused tests across core controller behavior, watch/informer projection, SQLite store callbacks, HTTP routes, server wiring, and task-store write wiring.

Validation

• PATH=/Users/tafeng/.bun/bin:$PATH bun --config=/dev/null test src/core/task-controller.test.ts src/core/agent-task.test.ts src/core/informer.test.ts src/local/sqlite-agent-task-store.test.ts tests/server/agent-tasks.test.ts src/server/task-controller-wiring.test.ts src/server/agent-task-store-wiring.test.ts -> 91 pass, 0 fail
• PATH=/Users/tafeng/.bun/bin:$PATH bun run typecheck -> pass
• PATH=/Users/tafeng/.bun/bin:$PATH bun run check -> exit 0 with existing warnings outside this change
• PATH=/Users/tafeng/.bun/bin:$PATH bun run build -> pass
• PATH=/Users/tafeng/.bun/bin:$PATH bun --config=/dev/null test --timeout 60000 -> summary reports 7503 pass, 7 skip, 0 fail; Bun returned code 2 after the clean summary, matching the pre-existing full-suite harness behavior observed before the final review fixes