feat(coord): bus-native task assignment + supervisor actuator + MCP tools (#345)

[mercurialsolo]

PR4 of the supervisor RFC (#342). Closes #345.

Stacked on #352 (will retarget to main once #352 merges).

First turn where the supervisor actually acts. Pending tasks move to ASSIGNED via mailbox writes, roleless tasks go straight to spawn. The crash-safety claim from the epic ("restart re-converges from coord.db") moves from aspirational to tested.

Reconciler decides

`Supervisor::tick()` was a no-op skeleton in #352. It now emits:

• `AssignViaMailbox` for PENDING tasks with a `role`.
• `Spawn` for PENDING tasks without a role.
• `Spawn` (claim-fallback) for ASSIGNED tasks past `claim_timeout_min` with no observable session at their cwd.

Hard ceiling on in-flight (`Assigned + Running`) so a backlog can't push the fleet past `policy.max_concurrent`.

Unknown observed sessions stay load-bearing: the spawn-fallback path gates on Running/Idle observations only; Unknown is treated as "do nothing this tick." RFC v2 §6's no-actuation backstop survives.

Actuator (`src/coord/actuator.rs`)

Pairs with the reconciler. `apply(&mut conn, &SideEffects, &Action)` carries each action out in three deterministic steps: insert attempt row → perform side effect → log transition. A side-effect failure stops before the transition is recorded so the next tick re-emits the action. The reconciler/actuator split keeps reconciler tests pure (no bus, no terminal) and keeps decisioning out of the actuator.

`SideEffects` trait abstracts the bus/launcher:

• `LiveSideEffects` (production) writes through the real bus publish path; spawn is stubbed for PR5.
• `NoopSideEffects` covers the `--no-default-features --features hive` build.
• `RecordingFx` (tests) asserts what fired without standing up either.

Crash-safety test (load-bearing)

The epic's headline claim. The test:

1. Boots a "daemon", assigns three tasks, three publishes fire.
2. Simulates kill -9 by constructing a fresh `RecordingFx` and re-running the same actions against the same DB.
3. Zero re-publishes — the ledger is the source of truth, not in-memory state.

Companion test: `assign_is_idempotent_against_already_assigned_task` covers the per-action race.

MCP tools

Three new tools on the bus MCP server (`src/bus/mcp.rs`):

• `submit_task` — file work to the supervisor. Carries every NewTask field including per-task `policy` JSON. Equivalent to the (forthcoming) `task.created` bus message intake; the "supervisor is just a privileged bus participant" claim made operational from the MCP side.
• `list_tasks` — read fleet view, optional state filter.
• `task_status(id)` — single task with the full transition log so operators don't need `sqlite3` archaeology.

Bus's existing rmcp tool router picks them up; no new server surface.

Headless wiring

`run_headless()` runs the actuator after the reconciler each tick. Emits a `supervisor_tick` event with `{emitted, actuated, errors}` counts so dashboards can chart fleet throughput. Per-action failures log `supervisor_action_failed` — visible without grepping logs.

Out of scope

• Real `spawn_session` against the terminal launcher — PR5 pairs it with the verifier runner so the spawn path has the `attempt → spawn → verify` chain in one place.
• `task.created` bus-intake — submit-via-publish covered by `submit_task` MCP tool today; the bus-message intake equivalence lands with PR5.
• `retry_task` MCP tool — admin surface, will land with PR7's exporter.
• TUI task list view — also PR7.

Verification

```
cargo check --all-targets ✓
cargo check --all-targets --no-default-features --features hive ✓
cargo clippy both feature sets -- -D warnings ✓
cargo fmt --all -- --check ✓
cargo test --all-targets → 733 + 744 + 78 + 8 = 1563 pass
```

Test plan

• After feat(coord): supervisor schema + reconciler skeleton + ingest + schema-version gate (#345) #352 + this merge: `claudectl --headless` with a coord DB containing a PENDING task → log shows `supervisor_tick {emitted:1, actuated:1, errors:0}`; bus DB has a `task.assigned.` message addressed to the role.
• Manually call the MCP `submit_task` tool via the bus stdio server with a payload that includes `{name, cwd, prompt, role:"backend"}` → returns `{task_id, state:"PENDING"}`; task shows up in `list_tasks`.
• Kill the daemon mid-tick (kill -9 the headless process) → restart → `task_status` shows no duplicate attempts.

🤖 Generated with Claude Code