ui-server: schedule proposals and publication commit on the write worker #3003

Part of epic #2850.

Context

The schedule service (packages/ui-server/src/schedules/service.ts, routes in packages/ui-server/src/routes/schedules.ts) commits on the app connection:

• propose, packages/ui-server/src/schedules/service.ts:488 (insert :532-536);
• approve, :549 (:563-574);
• publish, :581 (:615-638), with completePublication :415-448 and completeRetirement :454-462;
• cancel, :725 (:733-756);
• reopen, :804, with adoptRestoredRoot :772-781 and reconcile :466-478, :830-852.

rootInfo (:172-185) writes once, during boot (ready, :883, awaited at packages/ui-server/src/app.ts:756).

Scope

Move the route writes to the write worker. Each route answers what it answered before, once its commit has landed. Publication stays ordered with the Git work it records: a step that must observe Git between statements keeps that order, and the PR records how.

Out of scope

• rootInfo's boot-time write.
• schedules/admission.ts, which is not wired into the hosted app.
• The cron runner's schedule execution.

Acceptance criteria

• Each moved write commits on the ui.db write worker (openSqliteWriter, packages/ui-server/src/db/write-worker.ts) at synchronous=FULL, keeping its transaction contents and its order relative to journal, Activity and the other worker writes.
• A focused test fails if a moved write runs on the app connection (APP_CONNECTION_WRITE via watchWriteSites, packages/ui-server/tests/helpers/write-sites.ts) or commits below FULL (SQLITE_WRITE_BELOW_FULL). Mutation receipts in the PR show each guard failing on its named assertion.
• Every reader that relied on the write having committed when the call returned still sees it (awaits the write, or waits for writes submitted before it). Refusal classes are kept across the worker.
• Before/after receipts on the native pi UID 1000 cell under three dd … conv=fsync writers (tests: attribute recurring one-second native hosted health timeouts #2416 method, turn wait joined): no window ≥ 250 ms after ready attributed to a moved writer, or a recorded reason the cell does not exercise it.

Verification

bun run test packages/ui-server, bun run test ./tests, bun run check:pr --base origin/main, and the native hosted proof (scripts/prove-native-host.ts) under the fixture lock, with and without the fsync load.

Contract impact

None expected. A retyped public signature (api-report/ui-server.txt) needs the classification in docs/integration-contract/package-api.md checked first.