Codemod db pass-through calls to domain modules: tasks + agents (C1 part 1/3)

Rewrite ~525 call sites from `db.<method>()` to `db.<module>.<method>()`
for tasks and agents domains (including `getAgent`/`findAgent`/`getTask`
which live on the `entityCrud` field). Delete the corresponding
pass-through methods on AppDatabaseBase. Structural types that narrowed
`db` to a bag of flat methods (CapabilityMatchDb, EscalationDeps,
SweepStaleReviewsDeps) are reshaped to match the new namespace. Internal
callback references inside database.ts/database-base.ts now invoke the
owning module directly (e.g. `this.agents.saveAgent`) rather than the
deleted pass-through.

The codemod lives at scripts/codemod/remove-appdatabase-passthrough.mjs
and filters by owning module + optional explicit method list. It is
idempotent and does not re-rewrite already-namespaced calls.

src/main/worker/entry/crash-recovery.ts

@@ -48,12 +48,12 @@ export function handleWorkerExit(
       }
       // EXEC-02: Release execution lock on crash recovery
       if (run.taskId) {
-        db.releaseTaskLock(run.taskId, run.id);
+        db.tasks.releaseTaskLock(run.taskId, run.id);
       }
       affectedAgentIds.add(run.agentId);
       affectedCompanyIds.set(run.agentId, run.companyId);
 
-      const chain = db.getChainOfCommand(run.agentId);
+      const chain = db.agents.getChainOfCommand(run.agentId);
       if (chain.length > 0) {
         wakeAgentIfPossible(chain[0].id, run.companyId, "report_failed");
       }
@@ -98,8 +98,8 @@ export function handleWorkerExit(
         if (candidate.workspaceId) {
           db.releaseWorkspaceLock(candidate.workspaceId, candidate.id);
         }
-        const task = candidate.taskId ? db.getTask(candidate.taskId) : null;
-        const agent = db.getAgent(candidate.agentId);
+        const task = candidate.taskId ? db.entityCrud.getTask(candidate.taskId) : null;
+        const agent = db.entityCrud.getAgent(candidate.agentId);
         const connector = db.getConnector(agent.connectorId);
         const { workspace, lockMode } = resolveWorkspaceWithLockMode(db, task, agent, candidate.companyId);
         const recoveryCompany = recoverySnapshot.companies.find((company) => company.id === candidate.companyId);

src/main/worker/entry/types.ts

@@ -85,8 +85,8 @@ export interface WorkerServiceDependencies {
   dispatchRunToWorker: (params: {
     runId: string;
     companyId: string;
-    agent: ReturnType<AppDatabase["getAgent"]>;
-    task: ReturnType<AppDatabase["getTask"]> | null;
+    agent: ReturnType<AppDatabase["entityCrud"]["getAgent"]>;
+    task: ReturnType<AppDatabase["entityCrud"]["getTask"]> | null;
     connector: ReturnType<AppDatabase["getConnector"]>;
     workspace: ReturnType<AppDatabase["getWorkspace"]>;
     workspaceMode: "exclusive" | "shared" | "none";