fix(work): close monitor atomicity and completed-action replay gaps

[RHODIZSECURITY]

Stacked Work-durability slice on top of RHODIZ OpenMuse PR #3.

Scope

• ports upstream [Bug] Monitor state can commit before the task outcome that explains it CopilotKit/openmuse#30 monitor/outcome atomicity and recovery from 0aec955c78cad063d251c8d50432a252bab490f7;
• ports upstream [Bug] Replaying a completed prepared action can regress a task to waiting_approval CopilotKit/openmuse#36 completed reviewed-action replay source from 74efa28 + 620b2ab, with the replay regression adapted to the RHODIZ fork;
• does not add a second Work authority: in AUTH_BACKEND=rhodiz, OpenMuse Work remains a projection and its local TaskWorker stays disabled;
• preserves Hermes/MemoryOS/RHODIZ Action Fabric authority boundaries.

CopilotKit#32 disposition

The fork base e59e697b16fc61eae0ee05fbe99b2210213f1bba already contains the file-producing operation-identity fix and dedicated tests/work-idempotency.test.ts coverage for publication recovery, document checkpoint loss, attachment mapping loss, and model artifact/cache checkpoint loss. Upstream PR CopilotKit#45 remains open; this PR does not claim it was merged upstream.

A temporary second regression file created during the audit was removed as DUPLICATE after the existing coverage was discovered.

Validation

Validated source tree: 26c24d8592b7885ea4200adebd2259dbdac4e292.

Node 22.23.2 / pnpm 11.19.0 on isolated rhodiz-relay:

• focused durability set: 40/40 PASS;
• full suite: 210/210 PASS;
• root + mobile typecheck PASS;
• Biome PASS;
• pnpm audit --prod: no known vulnerabilities;
• server build PASS;
• web export PASS;
• iOS Expo prebuild --no-install PASS;
• git diff --check PASS.

Node 24.21.0 / pnpm 11.19.0 in node:24-bookworm:

• frozen lockfile/supply-chain verification PASS (1434 entries);
• focused durability set: 40/40 PASS;
• full suite: 210/210 PASS;
• root + mobile typecheck PASS;
• Biome PASS;
• pnpm audit --prod: no known vulnerabilities;
• server build PASS;
• web export PASS;
• iOS Expo prebuild --no-install PASS.

Remote head f81bf9b843c328a0dad38a13c4f8477f551b4dc5 resolves to the same validated tree SHA above. No production or HIL claim.