Add tasks.requires_filesystem column (v52) — per-task filesystem lock policy

Before v52, resolveWorkspaceWithLockMode walked a four-step fallback
chain (task → agent → project → any company workspace) and marked
every resolved row exclusive. In a multi-agent company every heartbeat
collapsed onto the same company workspace row, every run claimed the
same exclusive lock, and only one agent ever executed at a time.

Root cause is a missing column: per-task 'does this task touch the
filesystem?' had no place to live, so the orchestrator defaulted to
yes on everything. v52 gives that question its own column.

Backfill is conservative:
  - in-flight tasks (in_progress + active_run_id) → 1 (preserve
    the lease the dispatcher already holds)
  - todo/backlog tasks whose assignee is an engineering-flavoured
    role (CTO/engineer/developer/devops/sre or department =
    engineering) → 1
  - everything else → 0

TaskRecord now exposes requiresFilesystem on both entityCrud.getTask
and the snapshot read path.

src/main/database/schema.ts

@@ -17,6 +17,7 @@ import { createMigrationsV48V48 } from "./migrations/v48-v48";
 import { createMigrationsV49V49 } from "./migrations/v49-v49";
 import { createMigrationsV50V50 } from "./migrations/v50-v50";
 import { createMigrationsV51V51 } from "./migrations/v51-v51";
+import { createMigrationsV52V52 } from "./migrations/v52-v52";
 import {
   columnExists,
   nowIso,
@@ -214,6 +215,7 @@ export function runMigrations(
     ...createMigrationsV49V49(deps),
     ...createMigrationsV50V50(deps),
     ...createMigrationsV51V51(deps),
+    ...createMigrationsV52V52(deps),
   ];
 
   // Pre-migration snapshot. If any migration is pending we take a full