feat: complete self-hosted operations lifecycle

[Lucenx9]

Summary

Completes the Feature 004 self-hosted operations lifecycle through T138 while preserving ordinary, optional, fail-open Codex and Claude normal-profile integration.

T097–T113: operational administration

• Added status, doctor, repair and interrupted-operation recovery based on the existing per-effect operation journal.
• Added concurrency protection and safe cancellation boundaries.
• Added independent Codex and Claude API-key rotation without disclosing credentials.
• Closed the deferred repeated-setup thread with idempotent setup that does not duplicate accounts, keys, registrations, plugins, profiles, volumes or ownership records.

T114–T127: backup and upgrades

• Added integrity-checked PostgreSQL backups and restore rehearsal.
• Added same-schema and forward-only schema upgrades with writer draining, migration sequencing and readiness gating.
• Preserved signed-release, trust-policy and digest-pinned image verification.
• Added transactional migration-failure recovery and prohibited unsafe image-only rollback after a forward migration.

T128–T138: uninstall and purge

• Added selective Codex or Claude uninstall with client-local ownership-aware cleanup and independent key revocation.
• Preserved the other client, shared repository memory, unrelated configuration and equivalent external integrations.
• Added retained-data reinstall behavior; default uninstall retains PostgreSQL data, backups and other retained service state.
• Added separately confirmed destructive purge with exact target enumeration and containment checks.

Validation

• Runtime: Node.js 24.18.0 and pnpm 11.21.0.
• Full bounded offline suite: 736 tests passed; eight expected environment-gated skips; zero unexpected failures.
• Focused T097–T138 suite: 93 tests passed; one expected gated skip.
• Real disposable PostgreSQL backup, integrity verification and restore rehearsal passed.
• Real disposable GNOME Keyring/Secret Service integration passed.
• PostgreSQL migrations and idempotent rerun passed; transactional external migration recovery passed.
• Codex and Claude normal-profile lifecycle, Feature 003 activation/package integrity, catalog, advisory and all Compose validation passed.
• Formatting, ESLint, strict TypeScript, build and git diff --check passed.

Safety properties

• Mutations and deletion are restricted to manager-owned or SkillWire-owned assets.
• Ownership, symlink and path-containment checks cover malicious filesystem shapes.
• Cancellation and crash recovery stop at safe journaled boundaries.
• Credential-redaction and zero-unrelated-write checks passed.
• No production codex-skillwire or claude-skillwire wrapper is introduced.
• Ordinary Codex and Claude remain available and fail open when SkillWire or credentials are unavailable.

Scope boundary

• Complete: T097–T138.
• Explicitly out of scope and unchanged: T139–T161.

PR #16 independently fixed the pre-existing authentication rate-limit fallback defect. That correction is inherited from main and is not duplicated in this feature commit.