Codemod db pass-through calls to domain modules: tasks + agents (C1 part 1/3)

Rewrite ~525 call sites from `db.<method>()` to `db.<module>.<method>()`
for tasks and agents domains (including `getAgent`/`findAgent`/`getTask`
which live on the `entityCrud` field). Delete the corresponding
pass-through methods on AppDatabaseBase. Structural types that narrowed
`db` to a bag of flat methods (CapabilityMatchDb, EscalationDeps,
SweepStaleReviewsDeps) are reshaped to match the new namespace. Internal
callback references inside database.ts/database-base.ts now invoke the
owning module directly (e.g. `this.agents.saveAgent`) rather than the
deleted pass-through.

The codemod lives at scripts/codemod/remove-appdatabase-passthrough.mjs
and filters by owning module + optional explicit method list. It is
idempotent and does not re-rewrite already-namespaced calls.

src/main/document-lifecycle.ts

@@ -190,7 +190,7 @@ function maybeRaiseDeliverableReviewApproval(
   const companySettings = deps.db.getCompanyApprovalSettings(input.companyId);
   if (!companySettings?.reviewDeliverables) return null;
   if (deps.db.getCompanyExecutionMode(input.companyId) === "ai_cofounder") return null;
-  if (deps.db.hasPendingDeliverableReviews(input.companyId)) return null;
+  if (deps.db.tasks.hasPendingDeliverableReviews(input.companyId)) return null;
 
   const approvalId = deps.db.requestApproval({
     companyId: input.companyId,
@@ -207,9 +207,9 @@ function maybeRaiseDeliverableReviewApproval(
 
   if (input.authorAgentId) {
     try {
-      const agent = deps.db.getAgent(input.authorAgentId);
+      const agent = deps.db.entityCrud.getAgent(input.authorAgentId);
       if (agent.heartbeatEnabled) {
-        deps.db.setHeartbeat(input.authorAgentId, false, agent.heartbeatIntervalSec || 120);
+        deps.db.agents.setHeartbeat(input.authorAgentId, false, agent.heartbeatIntervalSec || 120);
       }
     } catch (error) {
       deps.logger.warn(