refactor(worker/state): introduce TaskStateService and route mutations through it

Slice 2 of the worker state consolidation refactor (spec sections 2 and 8).

Adds Worker/State/ITaskStateService + TaskStateService as the single component
that mutates Status, PlanningPhase, and BlockedByTaskId. Each transition is one
atomic ExecuteUpdate with a WHERE filter on the expected source status, so
parallel claims are TOCTOU-free. Side effects (queue wake on -> Queued, hub
TaskUpdated broadcast, chain advance + parent completion on terminal child)
are owned by the service so callers no longer need to remember them.

Migrated callers (mechanical, behavior preserved):
- TaskRunner: HandleSuccess/HandleFailure/MarkFailed/RunAsync/ContinueAsync
- StaleTaskRecovery: bulk recover stale Running tasks
- TaskResetService: status flip (worktree cleanup stays in service)
- PlanningSessionManager.StartAsync: status flip via state, token write via repo
- PlanningChainCoordinator.OnChildFinishedAsync: routes the next-sibling write
  through state.UnblockAsync (Slice 4 finishes the rewrite)
- ExternalMcpService.UpdateTaskStatus: Queued case via state.EnqueueAsync

Repo Mark*Async helpers (MarkRunning/MarkDone/MarkFailed/FlipAllRunningToFailed)
are now internal; ClaudeDo.Data grants InternalsVisibleTo to ClaudeDo.Worker
and ClaudeDo.Worker.Tests for the existing repo-level tests.

DI: TaskStateService is registered as Singleton in both the main app and the
external-MCP app; the queue-wake delegate captures sp -> QueueService.WakeQueue
to break the TaskStateService -> QueueService -> TaskRunner -> TaskStateService
construction cycle. PlanningChainCoordinator takes Func<ITaskStateService> for
the same reason; Slice 3 will replace both with IQueueWaker.

Tests: TaskStateServiceTests covers happy + reject for every transition, the
parallel StartRunningAsync claim race, child-terminal chain advancement, and
stale recovery. Existing service/repo tests are updated to construct the new
state-service via a TaskStateServiceBuilder helper. Pre-existing constructor
drift in QueueService/ExternalMcp/PlanningHub tests is patched to keep the
test project building (the surrounding test logic is otherwise untouched).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Services/QueueServiceSlotGuardTests.cs

@@ -54,7 +54,7 @@ public sealed class QueueServiceSlotGuardTests : IDisposable
         var wtManager = new WorktreeManager(new ClaudeDo.Data.Git.GitService(), dbFactory, _cfg, NullLogger<WorktreeManager>.Instance);
         var argsBuilder = new ClaudeArgsBuilder();
         var runner = new TaskRunner(fake, dbFactory, broadcaster, wtManager, argsBuilder, _cfg,
-            NullLogger<TaskRunner>.Instance);
+            NullLogger<TaskRunner>.Instance, TaskStateServiceBuilder.Build(dbFactory).State);
         var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance);
         return (service, fake);
     }

tests/ClaudeDo.Worker.Tests/Services/QueueServiceTests.cs

@@ -55,7 +55,7 @@ public sealed class QueueServiceTests : IDisposable
         var wtManager = new WorktreeManager(new GitService(), dbFactory, _cfg, NullLogger<WorktreeManager>.Instance);
         var argsBuilder = new ClaudeArgsBuilder();
         var runner = new TaskRunner(fake, dbFactory, broadcaster, wtManager, argsBuilder, _cfg,
-            NullLogger<TaskRunner>.Instance);
+            NullLogger<TaskRunner>.Instance, TaskStateServiceBuilder.Build(dbFactory).State);
         var service = new QueueService(dbFactory, runner, _cfg, NullLogger<QueueService>.Instance);
         return (service, fake);
     }

tests/ClaudeDo.Worker.Tests/Services/StaleTaskRecoveryTests.cs

@@ -54,7 +54,8 @@ public sealed class StaleTaskRecoveryTests : IDisposable
         await _tasks.AddAsync(running);
         await _tasks.AddAsync(queued);
 
-        var recovery = new StaleTaskRecovery(_db.CreateFactory(), NullLogger<StaleTaskRecovery>.Instance);
+        var built = TaskStateServiceBuilder.Build(_db.CreateFactory());
+        var recovery = new StaleTaskRecovery(built.State, NullLogger<StaleTaskRecovery>.Instance);
         await recovery.StartAsync(CancellationToken.None);
 
         var r = await _tasks.GetByIdAsync(running.Id);

tests/ClaudeDo.Worker.Tests/Services/TaskResetServiceTests.cs

@@ -34,10 +34,12 @@ public class TaskResetServiceTests : IDisposable
     {
         var fakeHub = new RecordingHubContext();
         var broadcaster = new HubBroadcaster(fakeHub);
+        var built = TaskStateServiceBuilder.Build(db.CreateFactory());
         var svc = new TaskResetService(
             db.CreateFactory(),
             wtMgr,
             broadcaster,
+            built.State,
             NullLogger<TaskResetService>.Instance);
         return (svc, fakeHub.Proxy);
     }
@@ -111,7 +113,7 @@ public class TaskResetServiceTests : IDisposable
         {
             var updated = await new TaskRepository(ctx).GetByIdAsync(task.Id);
             Assert.NotNull(updated);
-            Assert.Equal(TaskStatus.Manual, updated!.Status);
+            Assert.Equal(TaskStatus.Idle, updated!.Status);
             Assert.Null(updated.Result);
             Assert.Null(updated.StartedAt);
             Assert.Null(updated.FinishedAt);