fix(agent-org): isolate runtime persistence namespace

[ShiboSheng]

Problem

Agent Org's redesigned runtime still shared its private SQLite table names and definitions-file path with older releases. Downgrading could therefore recreate an incompatible legacy schema, and reopening the redesigned build could hit column mismatches before ordinary Rust or CLI session history loaded.

The previous pull request also accumulated follow-up commits that changed the approved design by adding a destructive schema epoch, migrating the retired definitions file, scanning legacy rows, and changing unrelated task-migration behavior.

Supersedes #799.

Fixes #791.

This is the third PR in the stack: #824 → #825 → this PR.

Solution

• Move all 13 Agent Org-owned runtime tables and their indexes into the agent_org_runtime_* namespace.
• At the existing database initialization barrier, use one BEGIN IMMEDIATE transaction to validate the complete canonical manifest, drop only the exact 13 retired table names, create a fresh canonical namespace when absent, revalidate it, and roll back on any failure.
• Fail closed for a partial or structurally unknown canonical namespace while preserving unknown tables outside the exact retirement registry.
• Store redesigned Team definitions only in agent-org-definitions.json; delete agent-orgs.json without parsing or migrating it, and never fall back to the retired path when cleanup fails.
• Preserve shared Session, CLI, message, turn-intent, Project, Work Item, Routine, and usage data.
• Include Neonforge's namespace hygiene sweep: remove ghost index drops, include views in schema-object validation, and document module-level schema helpers as test conveniences.
• Update the new PR feat(agent-org): add authoritative Team lifecycle #824 Starting regression test to delete from the canonical initial-input table.

The candidate c4190d9 commit is not present in the final history because it only renames watchdog test calls to runtime_connection(), an API introduced by the explicitly excluded 497ddc1 commit. PR #825 correctly retains get_connection(), so applying c4190d9 would not compile; adapting it produces no source change.

Potential risks

• The exact 13 retired Agent Org tables and the retired agent-orgs.json file are intentionally deleted. Legacy Agent Org runtime state and legacy custom Team definitions are not recoverable through this change.
• Downgrading creates an empty legacy Agent Org environment. Returning to this build deletes that temporary legacy environment while retaining the isolated redesigned runtime.
• Cross-version recovery while a Team is Starting, Working, Paused, or otherwise in flight is unsupported. Running old and new binaries concurrently against the same ORGII_HOME is also unsupported.
• This PR depends on feat(agent-org): flatten Team definitions and freeze capabilities #825, which depends on feat(agent-org): add authoritative Team lifecycle #824. It must not merge before its stack bases.
• The clean stacked rebuild passed focused and workspace Rust validation, but the full packaged cross-version matrix was not rerun after reconstruction. The PR remains Draft for that reason.
• Rollback is to run an older build sequentially; it recreates its own empty legacy tables. The redesigned agent_org_runtime_* tables remain isolated for a later return to the new build.

Verification

• cargo test -p agent_core core::coordination::schema -- --nocapture — 7 passed. Measured 25 samples: fresh median 4.41 ms, canonical no-op median 2.75 ms, and 13-table cleanup median 3.12 ms.
• cargo test -p agent_core agent_org -- --nocapture — 225 passed.
• cargo test -p agent_core core::definitions::orgs -- --nocapture — 13 passed.
• cargo test -p session_persistence turn_intents -- --nocapture — 13 passed.
• cargo test -p org2 agent_sessions::session_directory::aggregation::tests -- --nocapture — 13 passed.
• cargo check --workspace --all-targets — passed.
• cargo clippy -p agent_core -p app_paths -p org2 -p session_persistence --all-targets -- -D warnings — passed.
• git diff --check origin/codex/issue-757-pr2-clean-stack...HEAD — passed.
• Reverse production-SQL search found the 13 retired names only in the exact cleanup registry; rejected schema-epoch, legacy-definition migration, row-count instrumentation, rusqlite trace, and runtime_connection changes are absent.

No frontend or wire files changed, so UI screenshots are not applicable.

Architecture and performance audit

Architecture review covered compilation, deletion of the old fingerprint/reset path, canonical naming, namespace semantics, fail-closed defaults, shared-data boundaries, developer clarity, unchanged wire contracts, initializer parity, and definitions-path resolution.

The runtime cost is startup-only: one SQLite transaction over schema metadata and a fixed 13-name retirement list. There is no new polling, timer, worker, subscription, cache, row scan, or idle/hidden background work. Concurrent same-version initialization is serialized by SQLite and covered by a two-connection test.

Commit provenance

• Original namespace cutover: Shibo Sheng.
• Namespace hygiene sweep: Neonforge.
• PR feat(agent-org): add authoritative Team lifecycle #824 stack adaptation: Shibo Sheng.