Implement issue execution lock with deferred wake promotion

Add per-issue execution lock (executionRunId, executionAgentNameKey,
executionLockedAt) to prevent concurrent runs on the same issue.
Same-name wakes are coalesced into the active run; different-name
wakes are deferred and promoted when the lock holder finishes.

Includes checkout/release run ownership enforcement, agent run ID
propagation from JWT claims, wakeup deduplication across assignee
and mention wakes, and claimQueuedRun extraction for reuse. Adds
two DB migrations for checkoutRunId and execution lock columns.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/db/src/migrations/0012_perpetual_ser_duncan.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "issues" ADD COLUMN "checkout_run_id" uuid;--> statement-breakpoint
+ALTER TABLE "issues" ADD CONSTRAINT "issues_checkout_run_id_heartbeat_runs_id_fk" FOREIGN KEY ("checkout_run_id") REFERENCES "public"."heartbeat_runs"("id") ON DELETE set null ON UPDATE no action;

packages/db/src/migrations/0013_dashing_wasp.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "issues" ADD COLUMN "execution_run_id" uuid;--> statement-breakpoint
+ALTER TABLE "issues" ADD COLUMN "execution_agent_name_key" text;--> statement-breakpoint
+ALTER TABLE "issues" ADD COLUMN "execution_locked_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "issues" ADD CONSTRAINT "issues_execution_run_id_heartbeat_runs_id_fk" FOREIGN KEY ("execution_run_id") REFERENCES "public"."heartbeat_runs"("id") ON DELETE set null ON UPDATE no action;

packages/db/src/migrations/meta/_journal.json

@@ -85,6 +85,20 @@
       "when": 1771616419708,
       "tag": "0011_windy_corsair",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1771619674673,
+      "tag": "0012_perpetual_ser_duncan",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1771623691139,
+      "tag": "0013_dashing_wasp",
+      "breakpoints": true
     }
   ]
 }