feat: atomically enqueue Workshop replies

[dcellison]

Summary

• add a production-unused application service that atomically creates a canonical assistant reply and its pending Telegram text delivery
• allow projection advancement and outbox insertion to participate in a caller-owned SQLite transaction
• resolve the canonical Telegram binding internally and reject missing or ambiguous destinations
• keep all handlers, startup wiring, direct Telegram sends, and delivery authority unchanged
• update the Workshop transition ledger with the implemented boundary and remaining gates

Atomic contract

One transaction now owns:

1. the assistant message.created event
2. the projected canonical assistant message
3. the delivery.requested event
4. the pending delivery_outbox row
5. the canonical projection checkpoint through both event positions

Any binding-resolution, append, projection, outbox-insert, or commit failure rolls the whole unit back.

The caller supplies only the canonical inbound message, response body, and occurrence time. The service derives the agent, channel, and exactly one canonical Telegram binding; it accepts no Telegram chat ID or binding ID from the caller.

Failure and idempotency coverage

• missing Telegram binding fails without creating a reply
• multiple Telegram bindings fail without guessing
• projection failure rolls back both events, projection state, and outbox work
• outbox insertion failure rolls back the canonical reply
• changed response content fails closed
• a pre-existing message-only half-state is rejected instead of silently repaired
• restart retries and concurrent connections produce one deterministic reply and one delivery
• caller-owned transaction primitives reject use without an active transaction

Production impact

None. record_outbound_message_with_delivery has no production caller. The Workshop worker remains unregistered, and existing direct Telegram delivery remains authoritative.

Validation

• 147 focused Workshop delivery/foundation tests passed
• make check
• make typecheck
• full suite: 5,299 passed, 1 skipped