feat: replace Session Task Ledger with a SessionTodo current snapshot

## Problem

The Session Task Ledger is still a workflow-shaped authority with stable Task identities, mutation history, hierarchy, ownership, evidence, claim and settle paths, a paginated Host query, and a Task-specific Desktop panel. RFC #2290 accepted a narrower end state: one Session-local current Todo snapshot that records only the model latest explicitly written checklist.

Current main also removed generic turn-tail injection in #4278, so Todo recovery must be explicit and durable rather than injected into every provider request.

## Desired outcome

Replace the model-facing Session Task Ledger with a Host-owned SessionTodo current snapshot:

- todo_read returns the complete current ordered snapshot.
- todo_write atomically replaces the complete ordered snapshot.
- no revision, IDs, item CRUD, mutation history, cursor, watermark, hierarchy, owner, evidence, claim, or settle semantics.
- completed is model-reported progress only and never execution evidence.
- TUI renders settled semantic tool cards only.
- Desktop renders the same current snapshot as a flat read-only checklist.
- restart and compaction preserve the snapshot; the model reads it on demand.
- no Todo turn-tail or dynamic system-prompt injection.

## Migration and lifecycle

- Lazy bootstrap imports canonical legacy pending and in_progress Tasks as-is and maps blocked Tasks to pending while preserving the subject. Workflow-only blocked reasons are not imported.
- Terminal completed, failed, and cancelled Tasks are not imported.
- Uninitialized and initialized-empty are distinct durable states.
- First explicit todo_write wins and never merges legacy Task data.
- Once initialized, SessionTodo never reads legacy Task state again.
- Full/latest copies may copy current Todo only when the source is idle and the selected cut includes the latest committed turn.
- Historical cuts, before revisions, and active side conversations initialize Todo as explicitly empty.
- Remove/discard purges Todo; archive retains it; backup and restore cover both non-empty and initialized-empty documents.
- Old Task tables remain preserved during migration and rollback, without dual writes or dual product surfaces.

## Delivery

- [x] Storage foundation: current-document contract, bounds, schema/store, authentic internal writer, lazy bootstrap including blocked-to-pending preservation, initialized-empty, purge primitive, migration, and backup/restore (#4340). This remains dormant and creates no production Todo rows.
- [x] Atomic Host/product cutover: export and compose the single Host authority; enforce Session presence/admission; wire copy/discard/remove/archive; enable todo_read/todo_write and Desktop/TUI projection; and simultaneously disable the complete legacy Task demand chain (#4351). Host lifecycle composition does not land earlier because it would initialize snapshots while legacy Task mutations remain active.
- [ ] Retirement: remove legacy replay, codecs, tests, and tables after the migration and rollback window.

The cutover includes the old model tools, task.ledger.query/change feed, subagent task_id/claim/settle, Goal Task gate, conversation Task copy, Desktop Task panel, full Task writer composition, and new Deep Research task-id production.

Item-count and encoded-byte bounds are engineering-derived from the released Task limits and Runtime Host frame budget, not inherited from the deleted turn-tail budget.

Parent RFC: #2290
Supersedes the durable Task mutation-history direction in #4179 and Draft PRs #4239/#4241.

AI assistance disclosure: Codex helped audit current main, compare alternative interfaces, and draft this issue. I reviewed the scope and own the final position.