feat(04-02): wire CAS checkout and stale recovery into orchestration-service

- Add randomUUID import for pre-generated runId in CAS checkout flow
- Replace task-level hasActiveRun checks with db.checkoutTask CAS in startAgentHeartbeatRun and queueTaskRun
- Pass pre-generated runId to createRun (database.ts accepts optional id field)
- Log execution.checkout_rejected activity on CAS failure (D-04)
- Return fail("CHECKOUT_RACE_LOST") in queueTaskRun on CAS failure
- Rewrite wakeAgentIfPossible with proper lifecycle tracking via enqueueWakeupRequest
- Add stale lock recovery sweep at startup (resumeQueuedRuns) and each heartbeat tick
- Log execution.lock_recovered activity entries for recovered stale locks

src/main/database.ts

@@ -1196,13 +1196,14 @@ export class AppDatabase {
   }
 
   createRun(input: {
+    id?: string;
     companyId: string;
     taskId: string;
     agentId: string;
     workspaceId: string | null;
     connectorId: ConnectorId;
   }) {
-    const id = randomUUID();
+    const id = input.id ?? randomUUID();
     const ts = nowIso();
     const logPath = join(this.logsDir, `${id}.log`);
     this.transaction(() => {