fix(heartbeat): let manual wakes escape stale capacity parks (BLO-27141)

[kkroo]

Thinking Path

• Paperclip is the control plane that schedules and observes AI-agent work.
• Heartbeat wakes share a task-scope coalescing path, including provider-capacity scheduled-retry parks.
• A capacity denial can leave a run parked behind an upstream reset horizon even after capacity has recovered.
• An explicit operator wake is a request to re-probe now, but the old coalescing path returned the parked run and never rechecked capacity.
• This pull request supersedes only matching ccrotate capacity parks under the existing agent/issue locks, then queues a fresh manual wake.
• Issue identity and legacy ownership guards prevent a shared task key from canceling or absorbing a sibling issue's park.

Linked Issues or Issue Description

• Refs BLO-27141
• Related reliability work: #1316, #1196, and #1455.
• The existing bounded provider-capacity retry path is unchanged; this PR closes the manual unstrand gap documented in BLO-27141.

What Changed

• Detect explicit user/manual wakes and bypass direct coalescing only for ccrotate capacity scheduled retries.
• Cancel the matching parked run and linked wakeup request with manual_capacity_reprobe, plus durable lifecycle and activity audit records.
• Release stale issue checkout/execution ownership, while retaining checkout promotion when a replacement exists and restoring the checkout status when no replacement path remains.
• Scope issue wake coalescing by issue identity; legacy task-key-only rows are accepted only when no different issue owns the run.
• Add embedded-Postgres BDD coverage for manual replacement, audit evidence, ownership release, sibling isolation, concurrent wake convergence, and non-capacity retry preservation.

Verification

• pnpm exec vitest run server/src/__tests__/heartbeat-ccrotate-capacity-retry.test.ts --no-file-parallelism --maxWorkers=1 — 20/20 passed
• pnpm --dir server typecheck — passed
• git diff --check — passed
• Rebased cleanly onto origin/master before pushing.
• No UI surface or migration is involved.

Risks

• Behavior changes only for explicit user/manual wakes targeting provider-capacity parks; ordinary scheduled retries and non-capacity retries retain their existing behavior.
• Cancellation and replacement are serialized under the existing issue/agent locks and use conditional status updates.
• Legacy task-key fallback is deliberately conservative to avoid cross-issue cancellation or context bleed.
• No schema, API, UI, or migration changes.

Model Used

• OpenAI Codex, gpt-5.6-sol, reasoning mode xhigh, with tool use and code execution.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues or (b) described the issue in-PR
• I have run tests locally and they pass
• I have added or updated tests where applicable
• UI screenshots are not applicable because this change has no UI surface
• Documentation changes are not applicable; operational rationale is documented at the code paths
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

🔗 Paperclip issue: BLO-27141

[allyblockcast]

🔗 Paperclip issue: BLO-27141

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: a76601b

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• The capacity-only supersession keeps ordinary scheduled retries on their existing coalescing path.
• The issue identity and legacy-owner checks cover the shared-task-key cancellation boundary, with focused concurrent-reprobe coverage.
• Cancellation records lifecycle and activity evidence while releasing stale ownership before the replacement wake is queued.

Recommended Action

1. Merge when the remaining CI checks are green.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 64701ed

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• Manual capacity re-probes are narrowly scoped to explicit user wakes and preserve the existing scheduled-retry behavior for non-capacity paths.
• Issue-aware coalescing and conservative legacy task-key fallback prevent cross-issue cancellation, with concurrency and sibling-isolation coverage.
• Cancellation, ownership release, lifecycle events, and activity records are handled transactionally, with post-commit publication.

Recommended Action

1. No Critical or Important issues found; approve.