feat: add cross-language durable recovery

[reacher-z]

What changed

• Add native event-sourced start/resume APIs to the TypeScript and Python schedulers.
• Bind graph, original input, implementation identity, attempt budgets, and stable activity keys to an authoritative CAS event history.
• Add Tagged Durable JSON for exact finite binary64 values and explicit NodeSettledWithoutAttempt outcomes.
• Recover committed successes, advance safe interrupted attempts, and fail closed with IN_DOUBT_SIDE_EFFECT for ambiguous unsafe effects.
• Validate terminal projections, event identity, strict RFC 3339 timestamps, retry reservations, completion order, timer bounds, and commit-before-release invariants.
• Add bidirectional TypeScript/Python durable-history conformance for crash continuation, missing executors, and output-binding failures.
• Document the shipped behavior and its explicit checkpoint, lease/fencing, replay/fork, approval, and exactly-once boundaries.

Why

The alpha already had native schedulers and event stores, but they were not integrated. A process loss could not safely continue a run. This change makes the event stream the recovery source of truth and prevents committed work from being silently repeated while preserving conservative external-effect semantics.

Developer impact

The runtime package now depends on @graph-engineering/persistence and exports startDurableGraphRun / resumeDurableGraphRun (plus compatibility aliases). Python exports start_graph_run / resume_graph_run. The portable event vocabulary gains NodeSettledWithoutAttempt, and timer-backed duration fields are capped at 2,147,483,647 ms.

Validation

• Full workspace build, typecheck, lint, and tests
• Core: 37 tests
• TypeScript runtime: 81 tests
• Python: 486 tests; Ruff and explicit strict mypy (22 source files)
• Cross-language compiler/runtime/primitives/persistence conformance
• Python-produced interrupted history resumed in TypeScript
• Bidirectional terminal-history replay for missing-executor and output-binding failures, with zero new events and zero executor calls
• Seven npm tarball content checks and clean-install smoke tests
• Python wheel/sdist build and artifact audit
• Source and isolated-package quickstarts
• Fixture/docs checks, production dependency audit, schema-copy byte equality, and diff hygiene

Explicit boundaries

This does not claim distributed leases/fencing, checkpoint acceleration, replay/fork, approval callbacks, or universal exactly-once external effects. Registry publication remains deferred.