Refactor orchestration with a Rust lifecycle supervisor

[areshand]

Summary

• preserve the existing pre-implementation, implementation, post-implementation, and atomic completion lifecycle
• let the orchestrator choose the task graph, worker count, and task-specific responsibilities
• admit disjoint path-scoped writers concurrently when Linux Landlock can enforce isolation, with the serial fallback retained elsewhere
• start a dedicated Rust lifecycle reconciler in every tmux session
• move mechanical polling, exact terminal detection, pane cleanup, assignment settlement, abandoned validation-lease handling, and explicitly budgeted infrastructure retry out of prompts
• keep blocked-work routing, replacement scope, worker topology, and repair strategy as orchestrator decisions
• fix the inherited Python 3.8 CI failure in the native SWE repository adapter

Runtime boundary

The lifecycle reconciler runs under the non-writing orchestrator identity because that identity owns the tmux socket. It trusts only the wrapper-generated final status: ... exited rc=N marker; agent-authored “done” prose cannot trigger cleanup.

Protected assignment and validation-lease changes cross the existing typed authority socket. The authority supervisor remains the only protected-state writer. Infrastructure retry is disabled by default and is bounded by the per-agent --infra-retries N policy recorded at spawn time.

Security model

• the orchestrator cannot write the target repository
• workers can write only supervisor-authorized owned paths
• concurrent writers require non-overlapping paths and Landlock isolation
• reviewers and verifiers remain read-only
• the reconciler does not choose workers, responsibilities, paths, or semantic repairs
• workflow completion remains an atomic supervisor gate

Validation

• cargo test --locked — 36 passed on macOS, 37 passed on Linux
• cargo clippy --locked -- -D warnings
• cargo fmt --all -- --check
• bash tests/run.sh
• Python 3.8 full contract suite — 63 passed
• Linux root tests/malicious-orchestrator.sh

The lifecycle integration tests cover successful cleanup, assignment settlement, stale lease handling, blocked work preservation, exact-marker protection, retry execution, retry exhaustion, and idempotent reconciliation.