refactor(worker/state): introduce TaskStateService and route mutations through it

Slice 2 of the worker state consolidation refactor (spec sections 2 and 8).

Adds Worker/State/ITaskStateService + TaskStateService as the single component
that mutates Status, PlanningPhase, and BlockedByTaskId. Each transition is one
atomic ExecuteUpdate with a WHERE filter on the expected source status, so
parallel claims are TOCTOU-free. Side effects (queue wake on -> Queued, hub
TaskUpdated broadcast, chain advance + parent completion on terminal child)
are owned by the service so callers no longer need to remember them.

Migrated callers (mechanical, behavior preserved):
- TaskRunner: HandleSuccess/HandleFailure/MarkFailed/RunAsync/ContinueAsync
- StaleTaskRecovery: bulk recover stale Running tasks
- TaskResetService: status flip (worktree cleanup stays in service)
- PlanningSessionManager.StartAsync: status flip via state, token write via repo
- PlanningChainCoordinator.OnChildFinishedAsync: routes the next-sibling write
  through state.UnblockAsync (Slice 4 finishes the rewrite)
- ExternalMcpService.UpdateTaskStatus: Queued case via state.EnqueueAsync

Repo Mark*Async helpers (MarkRunning/MarkDone/MarkFailed/FlipAllRunningToFailed)
are now internal; ClaudeDo.Data grants InternalsVisibleTo to ClaudeDo.Worker
and ClaudeDo.Worker.Tests for the existing repo-level tests.

DI: TaskStateService is registered as Singleton in both the main app and the
external-MCP app; the queue-wake delegate captures sp -> QueueService.WakeQueue
to break the TaskStateService -> QueueService -> TaskRunner -> TaskStateService
construction cycle. PlanningChainCoordinator takes Func<ITaskStateService> for
the same reason; Slice 3 will replace both with IQueueWaker.

Tests: TaskStateServiceTests covers happy + reject for every transition, the
parallel StartRunningAsync claim race, child-terminal chain advancement, and
stale recovery. Existing service/repo tests are updated to construct the new
state-service via a TaskStateServiceBuilder helper. Pre-existing constructor
drift in QueueService/ExternalMcp/PlanningHub tests is patched to keep the
test project building (the surrounding test logic is otherwise untouched).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Infrastructure/FakeHubContext.cs

@@ -0,0 +1,39 @@
+using ClaudeDo.Worker.Hub;
+using Microsoft.AspNetCore.SignalR;
+
+namespace ClaudeDo.Worker.Tests.Infrastructure;
+
+public sealed record CapturedHubCall(string Method, object?[] Args);
+
+public sealed class CapturingClientProxy : IClientProxy
+{
+    public readonly List<CapturedHubCall> Calls = new();
+
+    public Task SendCoreAsync(string method, object?[] args, CancellationToken cancellationToken = default)
+    {
+        Calls.Add(new CapturedHubCall(method, args));
+        return Task.CompletedTask;
+    }
+}
+
+public sealed class CapturingHubClients : IHubClients
+{
+    public CapturingClientProxy AllProxy { get; } = new();
+    public IClientProxy All => AllProxy;
+    public IClientProxy AllExcept(IReadOnlyList<string> excludedConnectionIds) => AllProxy;
+    public IClientProxy Client(string connectionId) => AllProxy;
+    public IClientProxy Clients(IReadOnlyList<string> connectionIds) => AllProxy;
+    public IClientProxy Group(string groupName) => AllProxy;
+    public IClientProxy GroupExcept(string groupName, IReadOnlyList<string> excludedConnectionIds) => AllProxy;
+    public IClientProxy Groups(IReadOnlyList<string> groupNames) => AllProxy;
+    public IClientProxy User(string userId) => AllProxy;
+    public IClientProxy Users(IReadOnlyList<string> userIds) => AllProxy;
+}
+
+public sealed class CapturingHubContext : IHubContext<WorkerHub>
+{
+    private readonly CapturingHubClients _clients = new();
+    public CapturingClientProxy Proxy => _clients.AllProxy;
+    public IHubClients Clients => _clients;
+    public IGroupManager Groups => throw new NotImplementedException();
+}

tests/ClaudeDo.Worker.Tests/Infrastructure/TaskStateServiceBuilder.cs

@@ -0,0 +1,37 @@
+using ClaudeDo.Data;
+using ClaudeDo.Worker.Hub;
+using ClaudeDo.Worker.Planning;
+using ClaudeDo.Worker.State;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClaudeDo.Worker.Tests.Infrastructure;
+
+/// Test-only helper that wires TaskStateService and PlanningChainCoordinator
+/// against a shared DB factory, breaking the Func cycle between them.
+public static class TaskStateServiceBuilder
+{
+    public sealed record Built(
+        TaskStateService State,
+        PlanningChainCoordinator Chain,
+        CapturingHubContext Hub,
+        Func<int> WakeCount);
+
+    public static Built Build(IDbContextFactory<ClaudeDoDbContext> dbFactory)
+    {
+        var hub = new CapturingHubContext();
+        var broadcaster = new HubBroadcaster(hub);
+        var wakeCount = new int[1];
+
+        TaskStateService? state = null;
+        var chain = new PlanningChainCoordinator(dbFactory, () => state!);
+        state = new TaskStateService(
+            dbFactory,
+            broadcaster,
+            () => Interlocked.Increment(ref wakeCount[0]),
+            chain,
+            NullLogger<TaskStateService>.Instance);
+
+        return new Built(state, chain, hub, () => Volatile.Read(ref wakeCount[0]));
+    }
+}