fix(db): strip implicit data mutations from startup

`init()` ran three implicit data-repair queries on every boot:
`reconcileOrphanedTasks`, `reconcileUnreviewableTasks`, and a
secrets-table migration whose fallback glued legacy rows onto a
synthetic zero UUID when no current company existed. The first
two papered over state-machine leaks at init time — hiding the
real bug and making startup observably mutate production data;
the third silently connected ciphertext to a non-existent company
with no UI visibility and no deletion path.

Root fix: the startup path is now allowed exactly one mutation —
`interruptStaleRuns`, which is crash recovery (running-at-boot =
worker died mid-turn) and cannot be expressed anywhere else.

The dead-letter `in_review` case moves to the transition point:
`tasks-status.guardInReviewHasReviewer` refuses to advance a task
into `in_review` when its assignee is a top-level agent
(`reports_to IS NULL`) and the task is not flagged for user
review. Callers either pre-flag the task (the CEO-completion path
in `automation-run-completion.advanceToInReview` now does this)
or the transition is rejected. No more silent resurrection at
boot; the failure is visible and actionable at source.

The orphan-task reconcile disappears entirely — the `finishRun`
guard already enforces the invariant at the one place a run can
leave the in-progress state, and `recoverStaleLocks` handles
stuck executions at runtime.

The secrets migration now throws when neither
`settings.current_company_id` nor any company row exists, rather
than binding legacy ciphertext to `00000000-0000-0000-0000-000000000000`.
Legacy rows stay on the old table until the operator creates a
real company, at which point the upgrade succeeds deterministically.

Tests rewritten: the reconciliation regression suite now asserts
the transition-time guard and the lone `interruptStaleRuns`
behavior. `resolve-workspace.test.ts` catches up with the
exclusive-by-default lock policy committed earlier.

src/main/automation/automation-run-completion.ts

@@ -177,6 +177,15 @@ function advanceToInReview(
   statusMessage: string,
 ): void {
   const { db, logger, publishDomainChanged } = deps;
+  // The tasks-status guard refuses an `in_review` transition for a
+  // top-level assignee (reports_to IS NULL) unless the task is
+  // flagged for user review. Auto-completed runs owned by the CEO
+  // routinely trip that path — pre-flag them so the transition
+  // succeeds and the human becomes the reviewer.
+  const agent = db.getAgent(run.agentId);
+  if (agent.reportsTo === null) {
+    db.setTaskRequiresUserReview(taskId, true);
+  }
   db.advanceTaskStatus(taskId, "in_review", statusMessage);
   callbacks.handleTaskStatusChange(taskId, run.companyId, "in_progress", "in_review");
   const company = db.listSnapshot().companies.find((c) => c.id === run.companyId);
@@ -184,7 +193,6 @@ function advanceToInReview(
     const importantDocs = findImportantDocsForRun(db, run.id, run.companyId);
     if (importantDocs.length > 0) {
       db.setTaskRequiresUserReview(taskId, true);
-      const agent = db.getAgent(run.agentId);
       if (agent.heartbeatEnabled) {
         db.setHeartbeat(agent.id, false, agent.heartbeatIntervalSec || 120);
         logger.info(`[deliverable-review] Paused heartbeat for ${agent.name} — deliverable flagged for review.`);