refactor(worker/state): introduce TaskStateService and route mutations through it

Slice 2 of the worker state consolidation refactor (spec sections 2 and 8).

Adds Worker/State/ITaskStateService + TaskStateService as the single component
that mutates Status, PlanningPhase, and BlockedByTaskId. Each transition is one
atomic ExecuteUpdate with a WHERE filter on the expected source status, so
parallel claims are TOCTOU-free. Side effects (queue wake on -> Queued, hub
TaskUpdated broadcast, chain advance + parent completion on terminal child)
are owned by the service so callers no longer need to remember them.

Migrated callers (mechanical, behavior preserved):
- TaskRunner: HandleSuccess/HandleFailure/MarkFailed/RunAsync/ContinueAsync
- StaleTaskRecovery: bulk recover stale Running tasks
- TaskResetService: status flip (worktree cleanup stays in service)
- PlanningSessionManager.StartAsync: status flip via state, token write via repo
- PlanningChainCoordinator.OnChildFinishedAsync: routes the next-sibling write
  through state.UnblockAsync (Slice 4 finishes the rewrite)
- ExternalMcpService.UpdateTaskStatus: Queued case via state.EnqueueAsync

Repo Mark*Async helpers (MarkRunning/MarkDone/MarkFailed/FlipAllRunningToFailed)
are now internal; ClaudeDo.Data grants InternalsVisibleTo to ClaudeDo.Worker
and ClaudeDo.Worker.Tests for the existing repo-level tests.

DI: TaskStateService is registered as Singleton in both the main app and the
external-MCP app; the queue-wake delegate captures sp -> QueueService.WakeQueue
to break the TaskStateService -> QueueService -> TaskRunner -> TaskStateService
construction cycle. PlanningChainCoordinator takes Func<ITaskStateService> for
the same reason; Slice 3 will replace both with IQueueWaker.

Tests: TaskStateServiceTests covers happy + reject for every transition, the
parallel StartRunningAsync claim race, child-terminal chain advancement, and
stale recovery. Existing service/repo tests are updated to construct the new
state-service via a TaskStateServiceBuilder helper. Pre-existing constructor
drift in QueueService/ExternalMcp/PlanningHub tests is patched to keep the
test project building (the surrounding test logic is otherwise untouched).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/External/ExternalMcpService.cs

@@ -3,6 +3,7 @@ using ClaudeDo.Data.Models;
 using ClaudeDo.Data.Repositories;
 using ClaudeDo.Worker.Hub;
 using ClaudeDo.Worker.Services;
+using ClaudeDo.Worker.State;
 using ModelContextProtocol.Server;
 using TaskStatus = ClaudeDo.Data.Models.TaskStatus;
 
@@ -32,19 +33,22 @@ public sealed class ExternalMcpService
     private readonly QueueService _queue;
     private readonly HubBroadcaster _broadcaster;
     private readonly TagRepository _tags;
+    private readonly ITaskStateService _state;
 
     public ExternalMcpService(
         TaskRepository tasks,
         ListRepository lists,
         QueueService queue,
         HubBroadcaster broadcaster,
-        TagRepository tags)
+        TagRepository tags,
+        ITaskStateService state)
     {
         _tasks = tasks;
         _lists = lists;
         _queue = queue;
         _broadcaster = broadcaster;
         _tags = tags;
+        _state = state;
     }
 
     [McpServerTool, Description("List all task lists available in ClaudeDo.")]
@@ -173,14 +177,13 @@ public sealed class ExternalMcpService
         {
             case TaskStatus.Manual:
                 await _tasks.ResetToManualAsync(taskId, cancellationToken);
+                await _broadcaster.TaskUpdated(taskId);
                 break;
 
             case TaskStatus.Queued:
-                if (task.Status is TaskStatus.Running)
-                    throw new InvalidOperationException("Cannot enqueue a running task.");
-                task.Status = TaskStatus.Queued;
-                await _tasks.UpdateAsync(task, cancellationToken);
-                _queue.WakeQueue();
+                var enqueueResult = await _state.EnqueueAsync(taskId, cancellationToken);
+                if (!enqueueResult.Ok)
+                    throw new InvalidOperationException(enqueueResult.Reason ?? "Cannot enqueue task.");
                 break;
 
             default:
@@ -189,7 +192,6 @@ public sealed class ExternalMcpService
         }
 
         var reload = (await _tasks.GetByIdAsync(taskId, cancellationToken))!;
-        await _broadcaster.TaskUpdated(taskId);
         return ToDto(reload);
     }