Add tasks.requires_filesystem column (v52) — per-task filesystem lock policy

Before v52, resolveWorkspaceWithLockMode walked a four-step fallback
chain (task → agent → project → any company workspace) and marked
every resolved row exclusive. In a multi-agent company every heartbeat
collapsed onto the same company workspace row, every run claimed the
same exclusive lock, and only one agent ever executed at a time.

Root cause is a missing column: per-task 'does this task touch the
filesystem?' had no place to live, so the orchestrator defaulted to
yes on everything. v52 gives that question its own column.

Backfill is conservative:
  - in-flight tasks (in_progress + active_run_id) → 1 (preserve
    the lease the dispatcher already holds)
  - todo/backlog tasks whose assignee is an engineering-flavoured
    role (CTO/engineer/developer/devops/sre or department =
    engineering) → 1
  - everything else → 0

TaskRecord now exposes requiresFilesystem on both entityCrud.getTask
and the snapshot read path.

src/shared/types/records-core.ts

@@ -156,6 +156,15 @@ export interface TaskRecord {
   costUsd: number;
   taskType: string | null;
   requiresUserReview: boolean;
+  /**
+   * Per-task filesystem lock policy (v52+). When `true` the
+   * orchestrator resolves a workspace and holds it exclusively for
+   * the duration of the run; when `false` the run executes with
+   * `lockMode='none'` and agents run in parallel on shared read-only
+   * context. Inferred from agent role at task creation and toggled
+   * explicitly by callers that know their task mutates the tree.
+   */
+  requiresFilesystem: boolean;
   startedAt: string | null;
   completedAt: string | null;
   cancelledAt: string | null;