refactor(task-board): fence reviewer dispatch on ids, sign reviewer identity

[pedrofrxncx]

Implements apps/api/src/tools/task-board/review-claims-removal-spec.md — step A of its two-deploy rollout.

What

task_board_review_claims existed to do two unrelated jobs. Neither needs a table.

1. Idempotent dispatch → deterministic ids. The reviewer run's thread id is now derived from (task, reviewer, cycleAt.toISOString()), so the threads primary key is the fence: the racing triggers (60s sweeper, the task dialog's 10s poll) collapse on an INSERT … ON CONFLICT DO NOTHING, and the loser returns isNew: false before anything else happens — no duplicate thread, no duplicate review_requested, no duplicate run. The run also carries a matching deterministic DBOS workflow ID (review:<item>:<kind>:<cycle>), the stall-nudge:<item>:<thread> idiom.

2. Reviewer identity → HMAC. The rtok_ token is now a signature over the same tuple (review-token.ts, modelled on file-storage/share-password.ts: same signing key, same timingSafeEqual) instead of a random string resolved through the table. TASK_BOARD_REVIEW_DECISION verifies it statelessly, deriving the cycle from the existing lastInReviewTime helper. Semantics are unchanged: a missing/wrong token still records the decision with verified: false, so it never counts toward allEnabledReviewersVerifiedApproved. Fail open on recording, fail closed on merging. The web ship button's deliberate asymmetry is untouched.

Deviation from the spec

The spec puts the fence at the DBOS workflow ID alone. That is not sufficient: enqueueAgentRunForTask creates the thread, links it, and records activity before enqueueThreadRun, so both racers would still produce a thread and a timeline entry with only the run collapsing. Hence the deterministic thread id as the real fence.

For the same reason the compensation the spec deletes could not be deleted outright — a dispatch that throws after the thread exists would leave reviewerHandledThisCycle reading it as this cycle's reviewer forever. It is now a threads.delete of the fence thread instead of a claim-row delete.

Rollout

• This PR (A): claims are no longer written; claimReviewer and releaseReviewerClaim deleted. The decision tool accepts an HMAC match or a legacy claim lookup, so review cycles in flight across the deploy keep counting toward auto-merge. Table still present.
• Follow-up (B), after a day: delete the legacy branch, resolveReviewClaimByToken, TaskBoardReviewClaimTable, and add the drop migration.

Testing

• New review-token.test.ts: round-trip plus wrong-reviewer / wrong-task / wrong-cycle / tampered / empty rejection.
• bun test apps/api/src/tools/task-board/{review-token,enqueue-reviewer,review-sweeper}.test.ts — 17 pass. No existing test asserted claim behavior (nothing to invert).
• bun run check, bun run lint, bun run fmt, knip all clean.
• Not run: the real-Postgres integration tests and the end-to-end live-race check on a real card (spec's verification 2 and 4).

---

Summary by cubic

Fences reviewer dispatch on deterministic thread and workflow IDs keyed by (task, reviewer, cycle, attempt), and replaces claim-table tokens with HMAC-signed rtok_ tokens. This stops duplicate runs and verifies reviewer identity while keeping the “record unverified decisions but exclude them from auto-merge” behavior.

• Derives the reviewer thread ID from (task, reviewer, cycle, attempt) so the threads PK is the fence; the run uses a matching workflow ID review:<item>:<kind>:<cycle>:<attempt>. enqueueAgentRunForTask now accepts fence and returns isNew; on enqueue failure, it deletes the fence thread to avoid a stuck “handled” state.
• Mints and verifies reviewer tokens statelessly via review-token.ts (TASK_BOARD_REVIEW_DECISION checks an HMAC over (task, reviewer, current cycle)); unverified decisions still record but don’t count toward auto-merge. Falls back to legacy claim lookup for cycles dispatched before this change.

Rollout

• Step A: stop writing claims; remove claimReviewer/releaseReviewerClaim; mint HMAC tokens; accept legacy claim tokens for in-flight cycles.
• Step B (after cycles drain): delete the legacy branch, remove resolveReviewClaimByToken, and drop task_board_review_claims with its migration.

^{Written for commit b759ea0. Summary will update on new commits.}